memory-safe C++
summary
A new compiler and runtime claim to make C and C++ memory safe without changing source code, combining static analysis with an improved AddressSanitizer that requires no source modifications and reports buffer overflows double frees use after frees and new/delete mismatches. The runtime hooks CRT and Windows RTL allocators for better interop, adds a continue-on-error ASan 2.0 mode that logs errors and lets large test suites keep running, and the project already runs ~185 OSS builds weekly and has found bugs in 27 open source projects. Release targets Visual Studio 2022 17.5 preview (Nov 8).
AI-written summary · about
chapters (18)
- 0:00Memory safety in C++
- 2:16Why memory issues persist
- 3:40Return-oriented attacks
- 7:54Memory safety errors in C++
- 10:02Microsoft's security stack
- 13:20Control flow integrity
- 14:28Data-oriented attacks
- 19:05Real-world exploits
- 23:02Government mandates for safety
- 23:45Static vs dynamic analysis
- 27:17Address Sanitizer internals
- 34:52ASan one-and-done limits
- 37:00ASan 2.0 continue-on-error
- 42:49Testing with Address Sanitizer
- 47:34Demo: ASan detecting errors
- 56:55Future of memory-safe C++
- 57:18Prioritize memory safety now
- 1:04:48Q&A
related talks
01h 03mLifetime Safety in C++: Past, Present and Future
50mC++ Sanitizers & Fuzzing for the Windows Platform Using New Compilers...
43mEverything I learned about static analysis and program safety in C++
01h 06mSecurity Beyond Memory Safety - Using Modern C++ to Avoid Vulnerabilities by Design
45mThe existential threat against C++ and where to go from here
01h 26mA Path to Practically Safe C++
01h 02mTowards Correctness, Safety and Security in C++26
36mCode Analysis: Empowering developers to write performant, reliable, and safe C++