> The rate of safety defects between major C and C++ projects appears similar at first glance
How come? Surely there would be fewer memory leaks in a code base with proper RAII than in C code with malloc and free all over the place.
How come? Surely there would be fewer memory leaks in a code base with proper RAII than in C code with malloc and free all over the place.
Linux kernel (C): https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm...
Chrome (C++): https://www.cvedetails.com/product/15031/Google-Chrome.html?...
There’s some variability year over year, but if anything C appears to have a slight advantage over C++ in terms of memory corruption (840 vs 1004), with essentially the same number of overflow errors (322 vs 328). There is no comparable rust project, but initial evidence from the asahi gpu drivers hints that memory corruption errors are fundamentally eliminated.
This is obviously not accounting for confounding factors, hence my request for any peer reviewed evidence for the security claim. Until then, the facts don’t seem to be supporting it.
Feel free to provide evidence for other cross-comparable c & c++ codebases if you have.
Because that’s the only thing holding back some languages right? If only the programmers using them would get good, use static analysis tools then bugs would be eliminated.
Linux compiles and runs on many more architectures and hardware configurations than chrome, and it supports a frankly ridiculous number of peripherals up to and including the most complicated gpu accelerators ever made.
Chrome is indeed complex, but on what do you base your “vastly more” assertion?