Taming the UB Monsters in C++

a year ago

C++ community is actively working on hardening and securing C++ software, focusing on undefined behavior (UB) to improve safety and security.
Since C++11, constexpr compile-time code has been UB-free, ensuring safety during compile-time evaluation.
C++26 introduces improvements like eliminating UB for uninitialized variables and bounds-hardened standard library operations, enhancing security.
Efforts are underway to systematically catalog and address UB in C++, using tools like erroneous behavior, profiles, and contracts.
A white paper is planned to document and mitigate C++ language UB, aiming for parity with other modern languages in security vulnerabilities.
New proposals aim to eliminate UB exploited for remote code execution (RCE), significantly improving C++ software security.
The approach maintains C++'s performance and control, allowing opt-outs for cases where full performance is needed.
Adoption is designed to be easy, with many improvements requiring just a recompile, minimizing code changes.
The C++ committee is focusing on security as a priority, responding to increased cyber threats and aiming for significant safety improvements.

Hasty Briefsbeta