CppCon 2017: John Regehr “Undefined Behavior in 2017 (part 2 of 2)”

—
—
Undefined behavior is a clear and present danger for all application code written in C++. The most pressing relevance is to security, but really the issue is one of general software correctness. The fundamental problem lies in the refusal of C++ implementations (in general) to trap or otherwise detect undefined behaviors. Since undefined behaviors are silent errors, many developers have historically misunderstood the issues in play.

Since the late 1990s undefined behavior has emerged as a major source of exploitable vulnerabilities in C++ code. This talk will focus on trends in the last few years including (1) increased willingness of compilers to exploit undefined behaviors to break programs in hard-to-understand ways and (2) vastly more sophisticated tooling that we have developed to detect and mitigate undefined behaviors. The current situation is still tenuous: only through rigorous testing and hardening and patching can C++ code be exposed to untrusted inputs, even when this code is created by strong development teams. This talk will focus on what developers can and should do to prevent and mitigate undefined behaviors in code they create or maintain.
—
John Regehr: University of Utah, Professor

John Regehr is a professor of computer science at the University of Utah, USA. His research group creates tools for making software more efficient and correct. For example, one of his projects, Csmith, generates random C programs that have been used to find more than 500 previously unknown bugs in production-quality C compilers.

Outside of work John likes to explore the mountains and deserts of Utah with his family.
—
*-----*

[jaredmulconry]

As of September 2023, the Type Sanitizer doesn't have many active contributors, so progress looks to be slow. I haven't tried to use it, but it appears to be in a partially complete state as of right now.

[hlmukkel]

Hm why was this split into two parts? Well.. awesome talk regardless! Highly enjoyed this one.