News for hackers. Stuff that matters.
Re:C++ is a hack by pcwalton on Tuesday February 16, 2016 @12:40PM (#11111611)
Whether you actually call "free" doesn't matter. You're falling victim to the "smart pointers/modern C++ is memory safe" fallacy. It is not, for reasons I've elaborated on at length numerous times before.
Re:C++ is a hack by dragontamer on Tuesday February 16, 2016 @01:20PM (#11111925)
So are you going to elaborate again or post a blogpost of your points? Its hard to hold a discussion if the other side doesn't... discuss... things.
Re:C++ is a hack by pcwalton on Tuesday February 16, 2016 @01:27PM (#11111987)

    std::vector<std::string> v;
    v.push_back("Hello");
    for (auto&& s: v) {
        v.clear();
        std::cout << s; // use after free in modern C++
    }
There is no reasonable way for a compiler to precisely check for use after free in C++ short of changing the language, and this can be easily proven.
Re:C++ is a hack by dragontamer on Tuesday February 16, 2016 @02:17PM (#11112376)
Technically, that's a iterator invalidation and those are indeed hard to keep track of. There are runtime libraries that keep track of pointer-invalidation for you however.

In any case, a std::vector<shared_ptr<std::string> > would actually avoid the issue in this particular case.

Use after free... is more about use of raw pointers IMO. I wouldn't describe that code to be a "use after free" at all. In most languages, you are simply not allowed to change the container at all. Iterator invalidation is a hard issue in any language.

Re:C++ is a hack by pcwalton on Tuesday February 16, 2016 @02:40PM (#11112557)
Iterator invalidation does not result in remote code execution in other languages. Regardless of what you call it (and you are in the minority by not considering that code UAF) the result is the same when combined with vtables and attacker-influenced heaps: arbitrary code execution.

shared_ptr is also not memory safe when combined with references, which you need to use to call methods on the shared_ptr'd object or to pass those objects to most functions.

Re:C++ is a hack by gpderetta on Tuesday February 16, 2016 @07:26PM (#11114204)
Tecnically that's reference invalidation and no pure library is going to help you. You need compiler/runtime help (i.e. static analysis or some sort of sanitizer).