The developers of the LLVM project have proposed a number of changes aimed at enhancing the security of critical projects in C++ and providing tools to eliminate errors caused by buffer overflows. The work focuses on two main areas: providing a development model that allows for safe buffer handling, and enhancing the protection of the standard libc++ library.
The proposed safe programming model for C++ emphasizes using the classes provided by the standard library when working with buffers instead of manipulating raw pointers. For example, it is suggested to use the std::array, std::vector, and std::span classes, which will include runtime checks for memory bounds violations.
To combat dangerous programming practices in clang, it is proposed to issue compiler warnings for all pointer arithmetic operations, similar to the warnings produced by the clang-tidy linter when using the flag 'cppcoreguidelines-pro-bounds-pointer-arithmetic', which will be supported in the LLVM 16 release. A separate flag, which will be off by default, will be added to clang to enable these warnings.
In libc++, there are plans to implement an optional enhanced protection mode, which, when enabled, will catch certain situations at runtime that lead to undefined behavior. For instance, in the std::span and std::vector classes, accesses beyond the allocated memory will be monitored, and if detected, the program will terminate abnormally. The developers believe that these changes will keep libc++ aligned with C++ standards, as the method of handling undefined behavior cases is up to library developers, who may interpret undefined behavior as failures necessitating program termination.
During the runtime checks in libc++, categories are being planned for separation, which can be individually enabled. Some of the proposed checks that do not complicate operations or change the ABI are already implemented in safe mode libc++.
Additionally, a toolkit is planned to be developed for code adjustment, allowing the replacement of variables with raw pointers to containers and the application of alternative handlers in situations where a container cannot directly replace a pointer (for example, the construct ‘if(array_pointer)’ can be transformed into ‘if(span.data()’). Adjustments can be applied not only to local variables but also to type parameters with pointers.
Source: opennet.ru
