4 ms·
Something like 70% of all CVEs in C++ applications (including browsers--the actual type of application doesn't seem to matter much) are memory safety issues. Y
by Jweb_Guru 6y ago
Something like 70% of all CVEs in C++ applications (including browsers--the actual type of application doesn't seem to matter much) are memory safety issues. Yet the myth persists that memory safety isn't an important bug class for stuff written in modern C++. I think the converse is true: most C++ programmers tend to significantly underestimate the number of remaining bugs in their code that are memory safety bugs.
- edflsafoiewq 6y agoHow many memory safety issues are in the JIT? Because Rust won't help you there.
- Jweb_Guru 6y agoBugs related to the JIT are normally counted separately, AFAIK. The 70% figure tends to hold even in systems with no JIT. However, it would not surprise me if about 70% of JIT CVEs are memory safety bugs. The trend for unsafe Rust so far seems to be very similar BTW (about 70% of unsafe Rust CVEs are memory unsafety--contrasted with virtually no non-unsafe Rust CVEs that are memory unsafety, and all that were are due to compiler bugs). The overall trends tell me that in the absence of a proof assistant, however carefully you scour your code for bugs, you will miss some. And 70% of the ones you miss will be memory unsafety unless you are using a system that explicitly prevents this.
- steveklabnik 6y agoGoogle’s 70% was in C++ because it was talking about Chromium, Microsoft’s 70% was not categorized by language, and was simply “memory safety issues.”
- Jweb_Guru 6y agoThere have been a few other studies besides those two pointing to the 70% figure. It seems to be a curiously persistent figure, and I agree that it's not just about C++.