Lifetime Safety in C++: Past, Present and Future
summary
C++ is getting concrete safety gains: C++23 lifetime rules change temporary lifetime extension to eliminate some dangling references, compilers (MSVC, Clang, GCC) emit statement‑local lifetime warnings, and sanitizers catch many temporal bugs. Static tools like the Clang Static Analyzer and MSVC static analysis find use‑after‑free and use‑after‑move issues and print traces. An experimental kbit borrow‑checker reimplementation and runtime checks complement static work. Reported numbers show about 70% memory‑safety involvement in vulnerabilities at Microsoft.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:16Memory safety in C++
- 7:37Memory safety approaches
- 15:34C++ safety changes
- 21:03Temporal safety tools
- 30:17Data flow analysis
- 41:00Future of C++ safety
- 53:54Is C++ safer?
- 56:24Q&A annotations
- 59:14Q&A compile-time vs runtime
- 1:00:41Q&A borrowing rules
related talks
01h 06mmemory-safe C++
43mEverything I learned about static analysis and program safety in C++
01h 02mModern C++ Safety and Security At 20
01h 26mA Path to Practically Safe C++
01h 02mTowards Correctness, Safety and Security in C++26
01h 08mImplementing the C++ Core Guidelines’ Lifetime Safety Profile in Clang
01h 06mSecurity Beyond Memory Safety - Using Modern C++ to Avoid Vulnerabilities by Design
45mThe existential threat against C++ and where to go from here