Skip to content
STIMSMITH

Bounds checking

Concept WIKI v1 · 6/8/2026

Bounds checking is a verification technique—performed at run time, by compilers, or in hardware—that ensures every memory access falls within the valid range of an allocated object. It is a primary mechanism for enforcing memory spatial safety in programming languages and instruction-set extensions, though it can impose significant performance overhead that has motivated a variety of elimination, optimization, and verification techniques.

Overview

Bounds checking is the act of verifying, at the point of a memory access, that the address being read or written lies within the valid range (the "bounds") of the referenced object. It is a foundational mechanism for enforcing memory spatial safety, ensuring that programs do not access memory outside the objects they legitimately reference.

Unsafe memory accesses in popular systems languages such as C and C++ have been a leading cause of software vulnerability, which has motivated extensive work on bounds-checking techniques at the software, compiler, and hardware levels [arXiv:1907.04241].

Approaches to bounds checking

Software and language-level checks

Most high-level languages ensure spatial safety by performing dynamic bounds checks—for example, Java, C#, and Python. These checks are supported by maintaining length information and performing a run-time bounds check whenever an array is accessed, typically made possible by use of a virtual machine that tracks object metadata [UCAM-CL-TR-984].

An alternative to retrofitting C and C++ with checks is to move to languages whose safety is built in, such as via compiler-added bounds checks and more restrictive treatment of pointers. However, billions of lines of critical C and C++ code already exist and will continue to be relied upon, so adding spatial safety to C and C++ code remains valuable [UCAM-CL-TR-984].

Compiler-instrumented checks (e.g., SoftBound)

Compiler-based memory-safety systems such as SoftBound enforce spatial safety by checking whether every access to array elements is within the corresponding array bounds. Because every load and store is instrumented, the resulting overhead in execution time can be substantial [arXiv:1907.04241].

Hardware-assisted checks (CHERI)

The CHERI instruction-set extension is designed to add safety to C and C++, which are vulnerable by default to spatial-safety attacks. CHERI hardware integrates bounds information directly into capabilities, allowing bounds to be checked as part of normal memory accesses rather than via software instrumentation. The CHERI technical report dedicates specific sections to bounds-check implementation (e.g., Section 3.4.2 "Bounds check") and to fast-path bounds checking for application-class processors (Section 5.4.1 "Fast bounds check") [UCAM-CL-TR-984].

Performance overhead and redundant-check elimination

Because bounds checks can be costly, researchers have proposed techniques to identify and bypass redundant bounds checks. The CHOP framework uses Convex Hull OPtimization with profile-guided, model-based inference to identify redundant array bounds checks, deriving and updating per-function knowledge bases of sufficient conditions for elimination. On real-world applications and the SPEC benchmark, CHOP reports avoiding on average 80.12% of dynamic bounds-check instructions and improving performance up to 95.80% over SoftBound [arXiv:1907.04241].

Bounds checking in program verification

Bounds checking is also a target problem class for software verifiers. The Augmented Weak-Distance (AWD) framework extends the Weak-Distance numerical-optimization approach to floating-point program verification. Across 40 bounds-checking benchmarks initially selected from SV-COMP 2024, AWD achieves 100% accuracy, matching the state-of-the-art bounded model checker CBMC while running on average 170× faster. The static analysis tool Astrée, by contrast, solves only 17.5% of those benchmarks despite being fast [arXiv:2505.14213].

See also

LINKED ENTITIES

2 links
UCAM-CL-TR-984 USES
CHERI USES

CITATIONS

6 sources
6 citations
[1] SoftBound enforces memory spatial safety by checking if every access to array elements is within the corresponding array bounds, often resulting in high execution-time overhead due to bounds-checking instructions. CHOP: Bypassing Runtime Bounds Checking Through Convex Hull OPtimization
[2] The CHOP framework, based on Convex Hull OPtimization, bypasses redundant memory bounds checks via profile-guided, model-based inference and can avoid on average 80.12% of dynamic bounds-check instructions, improving performance up to 95.80% over SoftBound. CHOP: Bypassing Runtime Bounds Checking Through Convex Hull OPtimization
[3] The Augmented Weak-Distance (AWD) approach achieves 100% accuracy on 40 bounds-checking benchmarks from SV-COMP 2024, matching the bounded model checker CBMC while running on average 170× faster, whereas the static analyzer Astrée solves only 17.5% of those benchmarks. Augmented Weak Distance for Fast and Accurate Bounds Checking
[4] The CHERI ISA is focused on adding safety to C and C++, which are vulnerable by default to spatial-safety attacks, and an alternative to CHERI would be to use safe languages that add compiler-inserted bounds checks and use pointers more restrictively; even so, billions of lines of existing C and C++ code motivate adding spatial safety to those languages. UCAM-CL-TR-984 (CHERI technical report)
[5] Most high-level languages ensure spatial safety by performing dynamic bounds checks (e.g., Java, C#, Python), supported by maintaining length information and running bounds checks on every array access, often made possible by a virtual machine that tracks object metadata. UCAM-CL-TR-984 (CHERI technical report)
[6] The CHERI technical report dedicates Section 3.4.2 to "Bounds check" implementation and Section 5.4.1 to a "Fast bounds check" fast path for application-class processors, indicating that bounds checking is treated as a first-class hardware mechanism. UCAM-CL-TR-984 (CHERI technical report)