Secure Programming Practices in C++
summary
C++ has a smaller, safer subset to prefer and the talk shows concrete failure modes and fixes: the optimizer can remove credentials from memory (the disappearing memset), unsigned wraparound and signed overflow let length checks be bypassed (unsigned wraparound), and common bugs include stack/heap overflows, use‑after‑free and format string leaks. Practical remedies include the C++ Core Guidelines, prefer std::string, enum class, user‑defined literals, use_unique_ptr over new, avoid shared_ptr and raw pointers, and use sanitizers and fuzzers with static and dynamic analysis.
AI-written summary · about
chapters (41)
- 0:00Introduction
- 1:27Agenda
- 1:59What kind of specs exists
- 2:09C Core Guidelines
- 2:57C Coding Standard
- 3:34Common Weakness Enumeration
- 4:07Undefined Behavior
- 6:26Undefined Behavior Example
- 7:37Compiler Optimizations
- 8:16The Disappearing Memset
- 9:23Live Demo
- 10:30References
- 10:59Era of the SAE
- 11:42Exploitability
- 14:53Sign Integer Overflow
- 16:27Overflows
- 19:05Buffer Underflow
- 21:30Incorrect Type Conversion
- 22:07The Good Thing
- 23:45Use Your Tools
- 27:12Avoid loops
- 28:13Save casts
- 29:08Allocation
- 30:45Garbage Collection
- 31:19Make Sure
- 32:11No Semantics
- 33:33enum class
- 34:58string literal
- 35:45loop
- 36:12literals
- 36:51struct
- 37:09quote operator
- 37:40semantics to numbers
- 38:10sizes
- 38:45fuzzers
- 39:12taint
- 40:54pointer
- 42:24clever code
- 43:47shared pointer
- 45:45shared state
- 47:03modern C
related talks
14mEmbedded C and C++: A Security Perspective
50mSecure development with C++ - Lessons and techniques
01h 26mVulnerable C++
01h 13mPractical Tips for Safer C++
01h 06mSecurity Beyond Memory Safety - Using Modern C++ to Avoid Vulnerabilities by Design
48mSecure C++ Programming
01h 02mPractical Tips for Safer C++
43mC++ and Security: Can We Do Better?