{"id":13011,"date":"2025-01-15T12:25:02","date_gmt":"2025-01-15T19:25:02","guid":{"rendered":"https:\/\/mattfife.com\/?p=13011"},"modified":"2025-01-01T12:32:26","modified_gmt":"2025-01-01T19:32:26","slug":"google-implements-spatial-memory-safety-in-c","status":"publish","type":"post","link":"https:\/\/mattfife.com\/?p=13011","title":{"rendered":"Google implements Spatial Memory Safety in C++"},"content":{"rendered":"\n

After analyzing nearly 10 years of CVEs, Google researchers calculated that at least 40% of\u00a0safety exploits<\/a>\u00a0in C++ were related to\u00a0spatial memory exploits<\/a>\u00a0like writing to an out-of-bounds memory location.<\/p>\n\n\n\n

Google researchers<\/a>\u00a0showed they were able to \u201cretrofit\u201d spatial safety onto their C++ codebases, and to do it with a surprisingly low impact on performance. They used straightforward strategies such as bounds checking buffers and data structures – as is done in other languages and released a new, safer Hardened libc++<\/a>.\u00a0<\/p>\n\n\n\n

The results show up in this chart of segfaults across the entire fleet of computers before and after using the improvements. Their internal red team testing results were also much improved, uncovered over 1000 bugs and likely prevent 1000-2000 new bugs each year based on current development rate.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Here’s a\u00a0blog post about their results<\/a>.<\/p>\n\n\n\n

Articles:<\/p>\n\n\n\n