#safety
12 posts tagged #safety.
What a C++ team can actually point at when asked about memory safety
The question now arrives in procurement paperwork rather than in conference talks, and C++26 shipped without the profiles that were supposed to answer it. What exists today is less impressive and more useful: a hardened standard library measured at a fraction of a percent, sanitizers in CI, and warnings that catch the class of bug being asked about.
The hardened standard library turns an out-of-bounds read into a stop
GCC checks an out-of-bounds vector::operator[] at -O0 and stops checking at -O2, so the build you debug is guarded and the build you ship is not. One macro carries the check into the optimised build: -D_GLIBCXX_ASSERTIONS for libstdc++, _LIBCPP_HARDENING_MODE for libc++, _MSVC_STL_HARDENING for the MSVC STL. Google has reported this class of hardening cut its production segfault rate by about a third.
The unit bug that crashed into Mars
In 1999 the Mars Climate Orbiter was lost because one team's software spoke pound-force seconds and another's expected newton seconds. mp-units, a C++ quantities library, makes that whole bug class uncompilable. First post of a series that follows the library to its C++29 standardization bid.
Who gets to say a feature is not ready
Contracts are in the C++26 working draft. The committee voted against removing them, decisively. Bjarne Stroustrup and four co-authors are asking again anyway, before the final ballot, on the grounds that counting votes is the wrong way to settle whether a foundational feature is finished. Both cases, from the papers.
The August 2026 C++ mailing, and the fight over contracts
Forty-eight papers, and a dozen of them are the same argument. Bjarne Stroustrup and four co-authors want the C++26 contracts design replaced before the final ballot, the P2900 authors have answered, and the committee already voted once against removal. Plus profiles, a reflection paper from Barry Revzin, and the usual crop of ranges additions.
Clang's lifetimebound warns about a copy, and that is the problem
The lifetimebound attribute lets -Wdangling see through a function call, which is how clang catches a string_view into a temporary. It has no conditional form, so a function that returns a copy on some instantiations and a reference on others has to pick between missing real dangles and warning about correct code. A proposal on the LLVM forum wants to close that gap.
Chrome fixed 1,072 security bugs in two releases and 97% of its code is span-clean
Chrome 149 and 150 fixed more security bugs than the previous 23 milestones combined, and 97% of first-party Chrome code now compiles cleanly under strict unsafe-buffer warnings. The strategy is worth reading closely: harden C++ aggressively, migrate selectively, and admit openly that runtime mitigations are approaching diminishing returns.
C++26 makes an uninitialized read a defined bug
Reading an uninitialized variable has been undefined behavior in C++ since the beginning, and compilers optimize on that assumption. C++26 (P2795) reclassifies it as erroneous behavior: still a bug the compiler diagnoses, but with a defined value and no licence for the optimizer to delete surrounding code. A poisoned-stack demo shows the same source printing garbage under C++23 and a defined 0 under C++26.
Profiles take shape, and the contract C++26 left behind comes back
The other half of the Brno safety story: a profiles framework with real syntax (attributes, not pragmas) plus two concrete profiles from Stroustrup, and P3097 bringing virtual-function contracts back after they were cut from the C++26 MVP. All target C++29.
C++ is writing down all of its undefined behavior
The structural move at WG21 Brno was not a feature -- it was a catalogue. P3596 adds two annexes that enumerate every case of undefined behavior and every ill-formed-no-diagnostic-required corner in the standard, and P3100 turns that list into a case-by-case program to close each one for C++29. There are exactly 80 core-language UB cases, and 70% of them are memory-safety bugs.
WG21 Brno: with C++26 done, the committee turns to undefined behavior
The WG21 Brno meeting (June 8-13, 2026) was the first since C++26 was finalized, and per Herb Sutter's trip report the theme is unmistakable: catalogue and eliminate undefined behavior, push memory-safety profiles toward C++29, and finish the pieces the C++26 MVP deferred. Reflection, the headline of C++26, was not on the marquee -- and that is exactly what shipping looks like.
C++ Safety State of the Union: May 2026
C++ in May 2026 has four conversations running at once: regulators (CISA, EU CRA) demanding memory-safety roadmaps; the committee fighting over how to respond (Hagenberg vote 19 profiles / 9 Safe C++ / 11 both); what actually shipped in C++26 (P2900 contracts, P3471 hardened stdlib, P2996 reflection); and what the industry actually deployed (Chrome MiraclePtr -57% UAF, Google's 0.3% perf-cost data, Apple libc++ safe-buffers). They don't talk to each other in public. This essay wires them. Pre-Brno (8-13 June) reading.