Fix C++ Stack Corruptions with the Shadow Stack Library - Bartosz Moczulski - CppCon 2025 скачать в хорошем качестве

Fix C++ Stack Corruptions with the Shadow Stack Library - Bartosz Moczulski - CppCon 2025

https://cppcon.org --- Fix C++ Stack Corruptions with the Shadow Stack Library - Bartosz Moczulski - CppCon 2025 --- Fatal stack micro-corruptions, mysterious segmentation faults, and bus errors tamed live on stage, come and see! Operating systems, compilers, libraries, and C++ language itself provide multiple tools and abstractions to protect against memory corruptions, both for heap and stack. Standard containers like std::array or std::vector can check rages when accessing members (except the [] operator, by design). GNU C Library (glibc) features MALLOC CHECK . Compilers come with address sanitizers and stack protectors onboard. Linux has mprotect(). Lastly, Valgrind can detect hard-to-imagine misbehaviors, although often at a cost that is impossible or impractical to accept. And would you believe that all these countermeasures are sometimes just not enough?! There are treacherous scenarios that can sneak through all of these defense lines and frame perfectly innocent functions like pthread mutex unlock() into a nasty segmentation fault. To understand why and how it can happen we will take a deep dive into the fascinating world of calling convention and even disassemble one or two functions to inspect the machine code generated by the compiler. Finally, I will present Shadow Stack - a novel technique and a C/C++ library that can help identify and fix the true source of tricky stack corruptions by recursively narrowing the search scope of the function call graph. --- Slides: https://github.com/CppCon/CppCon2025/... Work at Hudson River Trading (HRT): https://tinyurl.com/safxfctf --- Bartosz Moczulski Bartosz Moczulski /pronounce: bar-tosh mo-chool-skee/ is a software engineer and consultant with 20 years of commercial experience in the digital TV industry and a proud holder of MSc degree in Computer Science from Wroclaw University of Technology (Poland). Bartosz is a big fan of the GNU/Linux ecosystem and open-source in general. He likes to call himself a Linux detective and rarely leaves a bug investigation unsolved. Bartosz has years of experience in C (GStreamer), C++ (WebKit), Linux security, and software integration in embedded systems (Yocto/OpenEmbedded, Buildroot), seeking an opportunity to pick some Rust soon. He is never afraid to descend to the assembler level or to spawn Ghidra or Radare2 when the situation demands it. All this time he is not losing sight of the bigger picture and can engage in projects at the architectural level. Bartosz is also passionate about knowledge sharing and ran numerous well-received internal trainings and workshops in the companies he used to work for. In his spare time, he likes to make wine and maintain his home lab, running a number of self-hosted services; both of these activities for the benefit of his friends and family. His current passion is medieval calligraphy which, being a left-hander, he has to write upside-down. He prefers a quill over a broad-edge nib and his favorite letters are ſ (long s) and þ (thorn). --- CppCon is the annual, week-long face-to-face gathering for the entire C++ community. The conference is organized by the C++ community for the community. You will enjoy inspirational talks and a friendly atmosphere designed to help attendees learn from each other, meet interesting people, and generally have a stimulating experience. Taking place this year in Aurora, Colorado, near the Denver airport, and including multiple diverse tracks, the conference will appeal to anyone from C++ novices to experts. Annual CppCon Conference - https://www.cppcon.org   / cppcon   https://x.com/cppcon   / cppconference     / cppcon   https://mastodon.social/@CppCon --- Videos Filmed & Edited by Bash Films: http://www.BashFilms.com YouTube Channel Managed by Digital Medium Ltd: https://events.digital-medium.co.uk --- #cpp #cplusplus #cppcon #cppprogramming #cplusplusprogramming #softwaredevelopment #softwareengineering #coding #code #computerscience #technology #technews #programming #programmer