A Formal Model for Capability Machines
control - flow integrity .