TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

C++ Software Security Sins: Basic Issues

57 点作者 0xedb大约 4 年前

5 条评论

MauranKilom大约 4 年前
This blog post feels weirdly superficial (haven&#x27;t looked at the video&#x2F;presentation).<p>&gt; <i>Array new and delete</i><p>&gt; <i>When you write new in your applications, you are creating unmanaged objects, and you are then required to call delete later on if you don’t want to risk leaks. So don’t use new and delete at all, as this is considered a C++ bad practice. Better yet, working in modern C++ allows you to use smart pointers and Standard library container classes that make it easier to match every new with exactly one delete.</i><p>The text is reasonable, but why is the heading &quot;<i>array</i> new and delete&quot;? There is a difference between new&#x2F;delete and new[]&#x2F;delete[], and calling delete[] on something created by new or vice versa is indeed going to cause problems. But that problem (and hence the section title) is more or less orthogonal to what the section body talks about.<p>Edit: The corresponding slide in the presentation does talk specifically about this kind of mismatch. It also comes to the same conclusion as the text (&quot;just use the STL&quot;). The connection between title and body was apparently lost in translation.<p>Maybe as more general feedback, I&#x27;m getting a strange vibe from this blog. Lots of &quot;top 5 &lt;C++ thing&gt;&quot; posts, links to Patreon-gated articles, ads for blog-owner-written books... Which would all be fine, but that plus an inconsistent summary of someone else&#x27;s talk raises a lot of warning signs for me.
zabzonk大约 4 年前
No even vaguely competent C++ programmer uses arrays of char such as char a[26] - this is completely bogus.
评论 #27268725 未加载
评论 #27272612 未加载
评论 #27268046 未加载
评论 #27268007 未加载
评论 #27268589 未加载
jahnu大约 4 年前
For any sufficiently mature programming language there exists older patterns that should be avoided but remain possible.
评论 #27270818 未加载
hedora大约 4 年前
Various smart pointer types solve the uninitialized pointer problem. You can even have variants that are guaranteed to be non-null (unlike, say, java, where null references can escape during initialization, especially in multithreaded code)
malaya_zemlya大约 4 年前
weirdly, this article advises to use unsigneds for array offsets, which is a fine way to overwrite the heap - when you accidentally decrement an array index past 0.