  Use-after-free (UAF) is a critical and prevalent problem in memory unsafe
languages. While many solutions have been proposed, balancing security,
run-time cost, and memory overhead (an impossible trinity) is hard.
  In this paper, we show one way to balance the trinity by passing more
semantics about the heap object to the allocator for it to make informed
allocation decisions. More specifically, we propose a new notion of thread-,
context-, and flow-sensitive "type", SemaType, to capture the semantics and
prototype a SemaType-based allocator that aims for the best trade-off amongst
the impossible trinity. In SeMalloc, only heap objects allocated from the same
call site and via the same function call stack can possibly share a virtual
memory address, which effectively stops type-confusion attacks and makes UAF
vulnerabilities harder to exploit.
  Through extensive empirical evaluation, we show that SeMalloc is realistic:
(a) SeMalloc is effective in thwarting all real-world vulnerabilities we
tested; (b) benchmark programs run even slightly faster with SeMalloc than the
default heap allocator, at a memory overhead averaged from 41% to 84%; and (c)
SeMalloc balances security and overhead strictly better than other closely
related works.
