# US 8,788,785 B1 · Systems and methods for preventing heap-spray attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,788,785 B1 - Document ID: US8788785B1 - Status: Granted - Kind: B1 - Application number: 13/006,705 - Filed: 2011-01-14 - Granted: 2014-07-22 - Earliest claimed: 2011-01-14 - Assignees: Symantec Corporation - Applicants: Uri Mann - Inventors: Uri Mann - Web page: https://patentgrep.com/patent/US8788785B1 ## CPC - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer-implemented method for preventing heap-spray attacks may include identifying an object-oriented program. The computer-implemented method may also include identifying, within the object-oriented program, a request to allocate memory for a polymorphic object. The polymorphic object may include a pointer to a virtual method table that supports dynamic dispatch for at least one method of the polymorphic object. The computer-implemented method may further include identifying an area of memory reserved for polymorphic objects. The computer-implemented method may additionally include allocating memory for the polymorphic object from the reserved area of memory. Various other methods, systems, and computer-readable media are also disclosed. ## Claims ### Claim 1 A computer-implemented method for preventing heap-spray attacks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying an object-oriented program; identifying, within the object-oriented program, a request to allocate memory for a polymorphic object, the polymorphic object comprising a pointer to a virtual method table that supports dynamic dispatch for at least one method of the polymorphic object; allocating an object heap that is reserved for objects and is separate from a default heap used for non-object data types; allocating memory for the polymorphic object from the object heap. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein: the object-oriented program comprises an executable file; the request comprises an instruction within the executable file. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein: the object-oriented program comprises a process; the request comprises an instruction within the process. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein: the object-oriented program comprises a source-code file; the request comprises a portion of the source-code file. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein identifying the request comprises inserting a hook into a memory allocation routine of the object-oriented program. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein identifying the request comprises analyzing the request to determine that the request is directed to allocating memory for the polymorphic object. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein allocating the object heap comprises reserving the object heap. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein allocating the object heap comprises identifying a heap reserved exclusively for polymorphic objects. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein allocating the object heap comprises: using a first range of addresses for the request to allocate memory for the polymorphic object: using a non-overlapping range of addresses for requests to allocate memory for non-object data types, wherein the non-overlapping range of addresses does not overlap the first range of addresses. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein allocating memory for the polymorphic object comprises generating at least one instruction to allocate memory for the polymorphic object from the object heap. ### Claim 11 A system for preventing heap-spray attacks, the system comprising: an identification module programmed to: identify an object-oriented program; identify, within the object-oriented program, a request to allocate memory for a polymorphic object, the polymorphic object comprising a pointer to a virtual method table that supports dynamic dispatch for at least one method of the polymorphic object; a reservation module programmed to allocate an object heap that is reserved for objects and is separate from a default heap used for non-object data types; an allocation module programmed to allocate memory for the polymorphic object from the object heap; at least one processor configured to execute the identification module, the reservation module, and the allocation module. ### Claim 12 (depends on 11) The system of claim 11, wherein: the object-oriented program comprises an executable file; the request comprises an instruction within the executable file. ### Claim 13 (depends on 11) The system of claim 11, wherein: the object-oriented program comprises a process; the request comprises an instruction within the process. ### Claim 14 (depends on 11) The system of claim 11, wherein: the object-oriented program comprises a source-code file; the request comprises a portion of the source-code file. ### Claim 15 (depends on 11) The system of claim 11, wherein the identification module is programmed to identify the request by inserting a hook into a memory allocation routine of the object-oriented program. ### Claim 16 (depends on 11) The system of claim 11, wherein the identification module is programmed to identify the request by analyzing the request to determine that the request is directed to allocating memory for the polymorphic object. ### Claim 17 (depends on 11) The system of claim 11, wherein the reservation module is programmed to allocate the object heap by reserving the object heap. ### Claim 18 (depends on 11) The system of claim 11, wherein the reservation module is programmed to allocate the object heap by identifying a heap reserved exclusively for polymorphic objects. ### Claim 19 (depends on 11) The system of claim 11, wherein the reservation module is programmed to allocate the object heap by: using a first range of addresses for the request to allocate memory for the polymorphic object; using a non-overlapping range of addresses for requests to allocate memory for non-object data types, wherein the non-overlapping range of addresses does not overlap the first range of addresses. ### Claim 20 A computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to: identify an object-oriented program; identify, within the object-oriented program, a request to allocate memory for a polymorphic object, the polymorphic object comprising a pointer to a virtual method table that supports dynamic dispatch for at least one method of the polymorphic object; allocate an object heap that is reserved for objects and is separate from a default heap used for non-object data types; allocate memory for the polymorphic object from the object heap.