TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

C++ Software Security Sins: Basic Issues

57 pointsby 0xedbalmost 4 years ago

5 comments

MauranKilomalmost 4 years ago
This blog post feels weirdly superficial (haven&#x27;t looked at the video&#x2F;presentation).<p>&gt; <i>Array new and delete</i><p>&gt; <i>When you write new in your applications, you are creating unmanaged objects, and you are then required to call delete later on if you don’t want to risk leaks. So don’t use new and delete at all, as this is considered a C++ bad practice. Better yet, working in modern C++ allows you to use smart pointers and Standard library container classes that make it easier to match every new with exactly one delete.</i><p>The text is reasonable, but why is the heading &quot;<i>array</i> new and delete&quot;? There is a difference between new&#x2F;delete and new[]&#x2F;delete[], and calling delete[] on something created by new or vice versa is indeed going to cause problems. But that problem (and hence the section title) is more or less orthogonal to what the section body talks about.<p>Edit: The corresponding slide in the presentation does talk specifically about this kind of mismatch. It also comes to the same conclusion as the text (&quot;just use the STL&quot;). The connection between title and body was apparently lost in translation.<p>Maybe as more general feedback, I&#x27;m getting a strange vibe from this blog. Lots of &quot;top 5 &lt;C++ thing&gt;&quot; posts, links to Patreon-gated articles, ads for blog-owner-written books... Which would all be fine, but that plus an inconsistent summary of someone else&#x27;s talk raises a lot of warning signs for me.
zabzonkalmost 4 years ago
No even vaguely competent C++ programmer uses arrays of char such as char a[26] - this is completely bogus.
评论 #27268725 未加载
评论 #27272612 未加载
评论 #27268046 未加载
评论 #27268007 未加载
评论 #27268589 未加载
jahnualmost 4 years ago
For any sufficiently mature programming language there exists older patterns that should be avoided but remain possible.
评论 #27270818 未加载
hedoraalmost 4 years ago
Various smart pointer types solve the uninitialized pointer problem. You can even have variants that are guaranteed to be non-null (unlike, say, java, where null references can escape during initialization, especially in multithreaded code)
malaya_zemlyaalmost 4 years ago
weirdly, this article advises to use unsigneds for array offsets, which is a fine way to overwrite the heap - when you accidentally decrement an array index past 0.