RETROFITTING SPATIAL SECURITY TO HUNDREDS OF MILLIONS OF LINES OF C++

Summary from the TLDR InfoSec newsletter

Google has made a large push to move to memory safe languages but in the process is embracing hardening C++ to bridge the gap. The security team has attempted to harden libc++ by adding bounds checking to improve spatial security. The team started by integrating the changes into the test and preproduction environment for a year before promoting to production for all but a few exceptions. The safety checks only add a 0.3% performance overhead, but they have resulted in the discovery of over 1,000 bugs and successfully interfered with a red team engagement.