Delivering safe C++ Bjarne Stroustrup Columbia University www.stroustrup.comOverview • The challenges of safety • What is “safety”? • C++ Evolution • with a focus on safety • C++ Core Guidelines Government have begun initiatives to drive the culture of software development towards utilizing memory safe languages. • ... • NSA advises organizations to consider making a strategic shift from programming provide little or no inherent memory protection, such as C/C++, to a memory safe language when possible. Some examples of memory safe languages are C#, Go, Java, Ruby™, and Swift®. • NSA: https://www.open-std

behavior; Medical device operates correctly in response to inputs, including in failure scenarios (Fail-safe Design), to prevent harm or hazards to patient. Security: Protection of systems, networks, and data Lines of C++ CodeReminder to a simple, but often overlooked, question! Why C++? 23Can C++ usage be safe? Mitigate Safety and Security Vulnerabilities What can we do then? 24 Explore Tooling Processes ➢ Being more careful in general is less flexible!What have we learned? Takeaways 69 ❖ Building safe complex medical robotics is actually very hard ❖ Standards/regulations are necessary but not sufficient

How to Use Exceptions The Exception Safety Guarantees How to Write Exception-Safe Code How to Refactor Non-Exception-Safe CodeContent 4 The Exception Situation How Do Exceptions Work Best Practices How to Use Exceptions The Exception Safety Guarantees How to Write Exception-Safe Code How to Refactor Non-Exception-Safe CodeWhy Another Talk on Exception Safety? 56 https://wg21.link/p07097 https://wg21 How to Use Exceptions The Exception Safety Guarantees How to Write Exception-Safe Code How to Refactor Non-Exception-Safe CodeHow Do Exceptions Work 24 void f() { std::string s{ “Some default initializer”

Component in Rust - Mozilla Hacks - the Web developer blog • Google Online Security Blog: Memory Safe Languages in Android 13 (googleblog.com)Spatial safety Temporal safetySpatial safety Temporal safetySpatial safety Safe Unsafe Safe Unsafe Safe-by- constructionApproaches to safety Safe Unsafe Safe Unsafe Safe-by- constructionApproaches to safety Safe Unsafe Safe Unsafe Safe-by- construction Safe but rejectedApproaches to safety Safe Unsafe Safe Unsafe Safe-by- construction Safe but rejected Opportunistic bug findingApproaches to safety Safe Unsafe Safe Unsafe Safe-by- construction Safe but rejected Opportunistic

David Olsen – Generic Programming CppCon 2024 Example Specialization template struct safe_sizeof { static constexpr std::size_t value = sizeof(T); }; https://godbolt.org/z/r6E7Wh675110 2024 Example Specialization template struct safe_sizeof { static constexpr std::size_t value = sizeof(T); }; template <> struct safe_sizeof { static constexpr std::size_t value = 0; 2024 Example Specialization template struct safe_sizeof { static constexpr std::size_t value = sizeof(T); }; template <> struct safe_sizeof { static constexpr std::size_t value = 0;

properties of baz )Function Composition struct fn_props { perf performance; bool is_memory_safe; bool can_terminate; }; constexpr fn_props compose(fn_props fn1, fn_props fn2) { static_assert( .performance = std::min(fn1.performance, fn2.performance), .is_memory_safe = fn1.is_memory_safe && fn2.is_memory_safe, .can_terminate = fn1.can_terminate || fn2.can_terminate, }; }Value Wrapper perf::fast, .is_memory_safe = false, .can_terminate = true, }> ,[](auto next, /* ...*/ ) { return next(vec[index], /* ...*/ ); });Index Example - Bounds Check Memory safe - accessing a vector element

▪ Mitigating deliberate attacks against vulnerable parts of a system ▪ Absolute measures (“Is it safe?” “Is it secure?”) very hard to attain ▪ Relative measures (“Is it safer?” “Is it secure against the difference between accidental wrapping and deliberate wrapping 34P0122R0 ARRAY_VIEW: BOUNDS-SAFE VIEWS FOR SEQUENCES OF OBJECTS ▪ Precursor to span & mdspan ▪ “Any failure to meet array_view’s correctly initialized array_view, then its bounds cannot be overrun.” ▪ Is this safe? 2015 35P0122R0 ARRAY_VIEW: BOUNDS-SAFE VIEWS FOR SEQUENCES OF OBJECTS ▪ Precursor to span & mdspan ▪ “Any failure

tools for your platform 02 03 04 Code reuse through libraries Building correct, secure, and safe systems Planning for the future Agenda Resources for learning modern C++ 0501 Obtaining tools tools for your platform 02 03 04 Code reuse through libraries Building correct, secure, and safe systems Planning for the future Agenda Resources for learning modern C++ 05Tools for your platform tools for your platform 02 03 04 Code reuse through libraries Building correct, secure, and safe systems Planning for the future Agenda Resources for learning modern C++ 0501 Obtaining tools

time_to_goal_s); TTG: 2.68432 s CppCon 2024: Improving our safety with a quantities and units library Safe unit conversions with mp-units NO UNITS LIBRARY MP-UNITS 28const double distance_m = 30.; const intermediate results not needed CppCon 2024: Improving our safety with a quantities and units library Safe unit conversions with mp-units NO UNITS LIBRARY MP-UNITS 28const double distance_m = 30.; const calculations without the need to rescale the units back and forth all the time while still being type-safe. 37QuantityOf auto time_to_goal(QuantityOf auto distance,

that if the compiler is msvc the # CMake generator is multi-config multi = True if self.settings.get_safe("compiler") == "msvc" else False if multi: self.folders.generators = os.path.join("build", "generators") If os=Windows, fPIC will have been removed in config_options() # use rm_safe to avoid double delete errors self.options.rm_safe("fPIC") ... You can see that we added a configure() method to the recipe delete them in the configure() method: def configure(self): self.settings.rm_safe("compiler.cppstd") self.settings.rm_safe("compiler.libcxx") Please, note that deleting these settings in the configure()