Memory safety is fundamental to computer security, as memory errors compromise core security mechanisms. The conventional approach to memory safety is to define it in terms of bad things that cannot happen. While this approach is presently used both in academia and industry, it also has recognized limitations. Reasoning about programs with complex behavior such as pointer casts is fragile, and it is unclear how to extend the negative lists-based approach to end-to-end security. As such, a general semantic definition of memory safety remains elusive.

We present a notion of gradual allocator independence that accurately captures the allocator-dependent aspects of memory safety, focusing on heap-specific memory errors such as null-pointer dereference, use after free, double free, and heap overflow. We consider a low-level language with access to an allocator that provides malloc and free primitives in a flat memory model. Pointers are just integers, and as such it is trivial to write memory-unsafe programs. Our approach is inspired by the previously suggested connection between memory safety and noninterference, but extends that connection in a fundamentally important direction towards downgrading to account for allocators running out-of-memory and for programs having pointer-to-integer casts. This establishes a formal correspondence between two classical decades-long research areas: downgrading in information flow control and memory safety. The significance of this connection is that it decouples having a defined concrete behavior from having a good behavior, unveils a well-grounded technical device for understanding the meaning of casts, and creates opportunities for future cross-pollination between the areas.

Joint work with René Rydhof Hansen and Andreas Stenbæk Larsen. To appear in PLDI 2026.