Perspective Security Beyond Memory Safety Using Modern C++ to Avoid Vulnerabilities by DesignMax Hoffmann Security Beyond Memory Safety CppCon 2024 2 Security Beyond Memory Safety Using Modern C++ to Security Beyond Memory Safety CppCon 2024 3 FIFTY SHADES OF SHOOTING YOURSELF IN THE FOOT WITH A RAILGUNMax Hoffmann Security Beyond Memory Safety CppCon 2024 4Max Hoffmann Security Beyond Memory Safety CppCon Security Beyond Memory Safety CppCon 2024 6Max Hoffmann Security Beyond Memory Safety CppCon 2024 7Max Hoffmann Security Beyond Memory Safety CppCon 2024 8Max Hoffmann Security Beyond Memory Safety CppCon

A Relaxed Guide to memory_order_relaxed Hans Boehm Paul E. McKenney Google Facebook CPPCON 2020std::atomic/std::atomic_ref and memory_order_relaxed ● C++ atomic sacrificing the simple threads-as-interleaving semantics ● by passing memory_order enum values to explicit atomic operations. ● In particular, memory_order_relaxed allows arbitrary visibility reordering with respect About memory_order_relaxed? ● Just a load, just a store: Full control, excellent efficiency and scalability! ○ Assuming aligned machine-sized atomic objects, that is…What is Not to Like About memory_order_relaxed

© 2019 Apex.AI, Inc. Safe and certified software for autonomous mobility TM Practical memory pool based allocators for Modern C++ by Misha Shalem misha.shalem@apex.ai © 2020 Apex.AI, Inc.● CppCon Andreas Pasternak ● Quote: “Memory pools and allocators are only one piece of the solution” Today we going to talk about this one piece in (more) depth © 2020 Apex.AI, Inc.Memory allocations in real-time practically for C++ memory allocations? We asked an independent 3rd party safety assessor and the answer was “It should comply to Autosar C++ 14 Coding Guidelines regarding memory allocations” © 2020

Bar std::string Bar std::string Bar std::stringObject Introspection (OI) Goals • Byte level memory footprint analysis for objects • Complete object type hierarchies • Dynamic allocations and containers hierarchy from a given root type • Understand the layout in memory of the entire hierarchy • Understand how to interpret data at memory offsets • Understand containers • Compiler generated debug Object Introspection Measurement Code Code GenerationApplied Example 1 • Unused container memory: Unused Sz = (C.capacity() - C.size()) * sizeof(element) Name TypeName Number ElemStatSz Length

Memory Model C++11 – C++23About Me: alex.dathskovsky@speedata.io www.linkedin.com/in/alexdathskovsky https://www.cppnext.comAlex Dathskovsky | alex.dathskovsky@speedata.io | www.linkedin.com/in/a hazards • an instruction can be executed when its operands have been calculated or loaded from memory • an instruction stalls if operands are not availableAlex Dathskovsky | alex.dathskovsky@speedata com/in/alexdathskovsky Reordering Types • Data dependencies must be honored • C++ compiler may reorder any memory access under the as-if rule • Different processors have different reordering guarantiesAlex

In this talk I'll tell you about C++ AoT compiler, JiTs for dynamic language, JiTs for binary translation, and dive back 20, 30, 40, 50, 60 years, way back into compiler history and read wonderful academic liberty, folks usually think of JIT as: The executable code changes after the program is loaded into memory and the linker/loader are done doing their work. On modern systems: pages mapped X at some point “just-in-time” compilation (JiT) techniques since the 1960s. Broadly, JiT compilation includes any translation performed dynamically, after a program has started execution. We examine the motivation behind

hilbert, matching types ● roboticists and their lack of beer ● external state memory accessor ● improving memory access using asynchronicity 4 ● motivations for std::mdspan ● review std::mdspan hilbert, matching types ● roboticists and their lack of beer ● external state memory accessor ● improving memory access using asynchronicity 5 ● motivations for std::mdspan ● review std::mdspan hilbert, matching types ● roboticists and their lack of beer ● external state memory accessor ● improving memory access using asynchronicity 6 ● motivations for std::mdspan ● review std::mdspan

Overview • The process of building a program • What a translation unit (TU) is, and its relationship to the code you write • The phases of translation • Declarations, definitions, and linkage • The one-definition compilation process translation • In C++, translation is performed upon a translation unit (TU) in nine well- defined stages • Evocatively named Phases 1 through 9 • A translation unit is defined (roughly) The Structure of a Program 20Copyright © 2020 Bob Steagall K E W B C O M P U T I N G Phases of Translation 21 CppCon 2020 - The Structure of a Program Phase 1 Phase 2 Phase 3 Phase 4 Phase 5 Phase

Processor Memory IO InterconnectComputer platform Processor + Interconnect + Memory 8Computer platform Processor + Interconnect + Memory 9Computer platform Processor + Interconnect + Memory 10Computer Interconnect + Memory 11Computer platform Processor + Interconnect + Memory 12Computer platform Processor + Interconnect + Memory 13Computer system Processor cores + Interconnect + Memory 14Computer 14Computer system Processor cores + Interconnect + Memory 15Computer system Processor cores + Interconnect + Memory 16 Complex and scary And mostly out of scope of our discussion anywayMemory 17

longest to compile - Expensive headers (with include chains!) - Support for incremental builds 40Translation Units 41 // templates.hpp #include template struct Sum { static const value = 0; };Translation Units 42 #include “templates.hpp” Sum<8192>::valueTranslation Units 43 ≈1.91 secondsTranslation Units 44 - #include and template costs are per translation unit - #pragma with the filesystem is not free - Caches abound but still expensive at scale 57 - Scales per translation unitQuerying Traces - Perfetto’s superpower 58 - Answer complex questions like - “How much