3 ms·

This was because of base::Unretained, which extracts raw C style pointers out of nice, safe C++ wrappers. Unfortunately, this is still a requirement in the adva

by theamk 8y ago

This was because of base::Unretained, which extracts raw C style pointers out of nice, safe C++ wrappers. Unfortunately, this is still a requirement in the advanced C++ software. I wish there was a nice way to remove a need for such things, like a weak pointer that work with unique_ptr, but I do not think it is possible to do this while preserving zero overhead implementation. The only practical solution I can think of is a shared_ptr-like object limited to have unique_ptr semantics. This will have overhead, but it could be worth it for the security gains.

pjmlp 8y ago
It kind of is, but requires a complete stack change. Solaris on SPARC, iOS and eventually Android, all make use of memory tagging. It doesn't cover all cases, but still better than not having it at all.
safercplusplus 8y ago
> like a weak pointer that work with unique_ptr, but I do not think it is possible to do this while preserving zero overhead implementation I think the type of pointer you're asking for basically does exist. First, you want to distinguish the cases when you want a "full featured" weak pointer that can gracefully handle the destruction of its target object [1] (rarely the case), or you just want a non-owning pointer that detects when the prorammer screws up and lets the target object be destroyed prematurely [2]. The latter is essentially just a non-owning reference counting pointer. The optimizer should be able to discard matching increments and decrements of the reference counter in many cases. > This will have overhead, but it could be worth it for the security gains. The performance cost of avoiding "unsafe" C++ elements is measurable, but reasonably modest [3]. [1] https://github.com/duneroadrunner/SaferCPlusPlus#registered-pointers https://github.com/duneroadrunner/SaferCPlusPlus#registered-... [2] https://github.com/duneroadrunner/SaferCPlusPlus#norad-pointers https://github.com/duneroadrunner/SaferCPlusPlus#norad-point... [3] https://github.com/duneroadrunner/SaferCPlusPlus-BenchmarksGame https://github.com/duneroadrunner/SaferCPlusPlus-BenchmarksG...

by theamk 8y ago

pjmlp 8y ago

It kind of is, but requires a complete stack change. Solaris on SPARC, iOS and eventually Android, all make use of memory tagging. It doesn't cover all cases, but still better than not having it at all.

safercplusplus 8y ago

> like a weak pointer that work with unique_ptr, but I do not think it is possible to do this while preserving zero overhead implementation I think the type of pointer you're asking for basically does exist. First, you want to distinguish the cases when you want a "full featured" weak pointer that can gracefully handle the destruction of its target object [1] (rarely the case), or you just want a non-owning pointer that detects when the prorammer screws up and lets the target object be destroyed prematurely [2]. The latter is essentially just a non-owning reference counting pointer. The optimizer should be able to discard matching increments and decrements of the reference counter in many cases. > This will have overhead, but it could be worth it for the security gains. The performance cost of avoiding "unsafe" C++ elements is measurable, but reasonably modest [3]. [1] https://github.com/duneroadrunner/SaferCPlusPlus#registered-pointers https://github.com/duneroadrunner/SaferCPlusPlus#registered-... [2] https://github.com/duneroadrunner/SaferCPlusPlus#norad-pointers https://github.com/duneroadrunner/SaferCPlusPlus#norad-point... [3] https://github.com/duneroadrunner/SaferCPlusPlus-BenchmarksGame https://github.com/duneroadrunner/SaferCPlusPlus-BenchmarksG...