Memory deallocation across a trust boundary

An apparatus comprising:

• a first software component and a second software component separated by a trust boundary:
• memory, at least some of the memory being shared between the first and second software components;
• an in-memory message passing facility implemented using the shared memory;
• and
• wherein the first software component is configured to deallocate memory from the shared memory which has been allocated by the second software component, by:
• taking at least one allocation to be freed from the message passing facility;
• and
• freeing the at least one allocation using a local deallocation mechanism while validating that memory access to memory owned by data structures related to memory allocation within the shared memory are within the shared memory.

A method performed by an operating system comprising a first library compartment and a second library compartment, the method comprising:

• sharing some memory between the first and second library compartments;
• implementing an in-memory message passing facility using the shared memory;
• using the first library compartment to deallocate memory from the shared memory which has been allocated by the second library compartment, by:
• taking at least one allocation to be freed from the message passing facility;
• freeing the at least one allocation using a local deallocation mechanism while validating that memory access to memory owned by data structures related to memory allocation within the shared memory are within the shared memory.