Memory Errors in C++ - A Static Analysis Point of View
Memory bugs have plagued C++ throughout its existence. While advances in recent standards have mitigated many safety issues, new language features always have the potential to create new kinds of problems. One such addition in C++17 was `string_view`. These lightweight “view” objects provide efficient access to data, simplify library function calls, and provide various convenience methods.
On the downside, while being very popular for performance reasons, views can easily lead to serious memory errors. Similarly to a raw pointer, the lifetime of a view is not tied in any way to its respective container’s lifetime, allowing it to “dangle” once the data is deallocated. Dereferencing a “dangling” view is a use-after-free error, very much like all the memory safety errors that take up 70% of the high-impact security bugs addressed each year at Microsoft and in the Chromium project. They are often found by dynamic analysis tools like sanitizers fairly late in the software development lifecycle, at which point the cost of fixing them is high.
In this talk, I review the status of memory safety in the language, then introduce static analysis tools designed to find and report use-after-free bugs in modern C++ source code.