Séminaire : Security of Multi-language Programs

Memory corruption is one of the oldest and most disruptive problems in computer security, especially in programs developed with unsafe languages such as C and C++. A promising alternative is Rust, which ensures memory safety without penalties at runtime through its ownership memory management. However, real-world systems are increasingly multi-language, and Rust programs often rely on unsafe features with the Foreign Function Interfaces (FFI) mechanism to interact with C legacy code. This integration, if not handled with extreme care, may reintroduce memory errors that Rust aims to avoid. The talk introduces Crema: a static analysis framework for detecting memory errors (i.e., memory leaks, double frees, and use-after-free) in Rust programs that include unsafe foreign C code. The approach combines Interprocedural Control Flow Graph construction over Rust and C intermediate representations, abstract interpretation, and taint analysis. We present the design, formalization, and experimental evaluation of the approach (SEFM 2025), discuss its extension toward abstract transition systems and a predicate query language, and outline ongoing challenges on the Rust-WebAssembly interaction.