5 ms·

Pretty much all web browser engines are full of use-after-free issues, not just IE.

pjmlp 13y ago
Correction, most applications coded in languages with manual memory management (C, C++, Pascal dialects), without use of static code analysers to verify correctness.
- mpyne 13y ago
  C++ has automatic memory management, but it also supports manual as an option and for some reason people keep using it. Of course it appears Rust will be much better in this regard.
  - pjmlp 13y ago
    It is amazing how many companies forbid the use of STL, templates and all related mechanisms that enable automatic memory management in C++ in their style guides, while still coding in C style.
    - pcwalton 13y ago
      Google uses the STL everywhere in Chrome.
      - pjmlp 13y ago
        Sure, but Google is special. We are talking about normal companies in regard what features one is allowed to use. If you mean security and STL. Do Google developers use std::array::at() instead of std::array::operator[]() as an example? Do they use smart pointers and STL containers instead of pure C++ pointers, arrays, strings everywhere? Do they use references instead of pointers in function arguments for out parameters? Do they use RAII for all types of resources? Do they produce builds with -Wall -Werror? Does the static analyzer run as part of the build? Being able to use STL is just the first step for secure C++.
    - beagle3 13y ago
      > enable automatic memory management enable OPTIONAL automatic memory management. The problem is it does not enforce it. I've never heard of a place that forbade STL, templates or such since 2005 or so. But it's not like STL or templates help; It's RAII that does. And there's no way to enforce RAII, so a stl::list<char * > is not any better at protecting you from use after free than char * x[] is.
      - pjmlp 13y ago
        Static analysis, although it only fixes your own code, not third party libraries.
  - pcwalton 13y ago
    > C++ has automatic memory management, but it also supports manual as an option and for some reason people keep using it. Automatic memory management in C++ does not effectively protect you from use-after-free.

pjmlp 13y ago

Correction, most applications coded in languages with manual memory management (C, C++, Pascal dialects), without use of static code analysers to verify correctness.

mpyne 13y ago
C++ has automatic memory management, but it also supports manual as an option and for some reason people keep using it. Of course it appears Rust will be much better in this regard.
- pjmlp 13y ago
  It is amazing how many companies forbid the use of STL, templates and all related mechanisms that enable automatic memory management in C++ in their style guides, while still coding in C style.
  - pcwalton 13y ago
    Google uses the STL everywhere in Chrome.
    - pjmlp 13y ago
      Sure, but Google is special. We are talking about normal companies in regard what features one is allowed to use. If you mean security and STL. Do Google developers use std::array::at() instead of std::array::operator[]() as an example? Do they use smart pointers and STL containers instead of pure C++ pointers, arrays, strings everywhere? Do they use references instead of pointers in function arguments for out parameters? Do they use RAII for all types of resources? Do they produce builds with -Wall -Werror? Does the static analyzer run as part of the build? Being able to use STL is just the first step for secure C++.
  - beagle3 13y ago
    > enable automatic memory management enable OPTIONAL automatic memory management. The problem is it does not enforce it. I've never heard of a place that forbade STL, templates or such since 2005 or so. But it's not like STL or templates help; It's RAII that does. And there's no way to enforce RAII, so a stl::list<char * > is not any better at protecting you from use after free than char * x[] is.
    - pjmlp 13y ago
      Static analysis, although it only fixes your own code, not third party libraries.
- pcwalton 13y ago
  > C++ has automatic memory management, but it also supports manual as an option and for some reason people keep using it. Automatic memory management in C++ does not effectively protect you from use-after-free.