RFC: Adopt C++ Safe Buffers? #31272

issue maflcko openend this issue on November 11, 2024
  1. maflcko commented at 2:30 pm on November 11, 2024: member

    C++ is unsafe, meaning that any code written in it may cause undefined behavior at runtime. One possible source of undefined behavior is out-of-range memory access.

    While some limited compiler warnings exist to detect some obvious cases, tracking down out-of-range memory access is usually done at runtime with debugging tools such as Valgrind or Asan. However, such tools can normally not be used in production, because they are not hardening tools, see https://stackoverflow.com/a/70004411/2084795. Some C++ standard libraries provide options to enable a hardened build, which can also be used in production, see https://libcxx.llvm.org/Hardening.html.

    However, this requires using the standard library containers or primitives to represent buffers. For example, instead of using a raw C-array, std::array should be preferred. Also, instead of using a raw C-pointer, std::span should be preferred.

    My understanding is that only libc++ offers such a hardened build right now, so the benefit would be limited. Also, the required patch is large-ish. However, I think it would be good to keep this hardening feature in mind and use std::array and std::span for new code. Possibly in the future, those can be enforced. std::array via https://clang.llvm.org/extra/clang-tidy/checks/modernize/avoid-c-arrays.html and std::span (really all buffer representations) via -Wunsafe-buffer-usage https://clang.llvm.org/docs/SafeBuffers.html.

  2. maflcko added the label Brainstorming on Nov 11, 2024
  3. laanwj commented at 11:02 am on November 14, 2024: member

    However, this requires using the standard library containers or primitives to represent buffers. For example, instead of using a raw C-array, std::array should be preferred. Also, instead of using a raw C-pointer, std::span should be preferred.

    i think we’ve already been going in this direction for quite a while.

  4. dergoegge commented at 7:52 pm on November 15, 2024: member

    My understanding is that only libc++ offers such a hardened build right now

    -D_GLIBCXX_ASSERTIONS appears to enable the same (or similar) for libstdc++, see here.


github-metadata-mirror

This is a metadata mirror of the GitHub repository bitcoin/bitcoin. This site is not affiliated with GitHub. Content is generated from a GitHub metadata backup.
generated: 2024-11-21 06:12 UTC

This site is hosted by @0xB10C
More mirrored repositories can be found on mirror.b10c.me