<story><title>Defensive Programming</title><url>https://interrupt.memfault.com/blog/defensive-and-offensive-programming</url></story><parent_chain><item><author>tyhoff</author><text>Author here. Firmware, for better and worse, is stuck in C&amp;#x2F;C++ land, so many of the topics here are essential to keep a complex, multi-MCU, multi-board setup in working order.&lt;p&gt;I&amp;#x27;m actually really curious what you all do in C&amp;#x2F;C++ to &lt;i&gt;prevent&lt;/i&gt; bad operations from ever being performed in the first place.&lt;p&gt;For example, should we just change our internal malloc &amp;#x2F; free to use double pointers instead?&lt;p&gt;&lt;pre&gt;&lt;code&gt;  bool malloc(size_t n, void **ptr) {
    *ptr = &amp;lt;memory&amp;gt;
  }

  void free(void **ptr) {
    ... &amp;lt;free&amp;gt;
    *ptr = NULL 
  }
&lt;/code&gt;&lt;/pre&gt;
This way, if anyone actually tries to use that pointer, it will crash the system (hardfault), instead of potentially using corrupted memory, which IMO is much worse.</text></item></parent_chain><comment><author>dragontamer</author><text>&amp;gt; I&amp;#x27;m actually really curious what you all do in C&amp;#x2F;C++ to prevent bad operations from ever being performed in the first place.&lt;p&gt;1. Go as far as you can with static memory. Don&amp;#x27;t call the allocator: its slow, sometimes requires inter-thread communications.&lt;p&gt;2. Dynamic uses often can use the stack: almost always in L1 of your local core. Stack allocations are self-cleaning, just don&amp;#x27;t pass those pointers to anyone else.&lt;p&gt;3. unique_ptr&amp;lt;blah&amp;gt; covers most of the true dynamic issues.&lt;p&gt;4. shared_ptr&amp;lt;blah&amp;gt; covers the rest of them.&lt;p&gt;---------&lt;p&gt;The above advice is just general-purpose &amp;#x2F; low-performance code.&lt;p&gt;If you&amp;#x27;re entering high performance coding (aka: you&amp;#x27;re actually worried about fragmentation, memory sizes, and such), then things get more complicated. Embedded is often RAM-restricted, so you end up in this complicated place where you need to think of highly-efficient techniques.&lt;p&gt;That&amp;#x27;s almost always a complexity &amp;#x2F; resource tradeoff. Efficient techniques are just innately more complex than general purpose techniques. Try not to reach for efficient coding unless you know its something you need to do</text></comment>
<story><title>Defensive Programming</title><url>https://interrupt.memfault.com/blog/defensive-and-offensive-programming</url></story><parent_chain><item><author>tyhoff</author><text>Author here. Firmware, for better and worse, is stuck in C&amp;#x2F;C++ land, so many of the topics here are essential to keep a complex, multi-MCU, multi-board setup in working order.&lt;p&gt;I&amp;#x27;m actually really curious what you all do in C&amp;#x2F;C++ to &lt;i&gt;prevent&lt;/i&gt; bad operations from ever being performed in the first place.&lt;p&gt;For example, should we just change our internal malloc &amp;#x2F; free to use double pointers instead?&lt;p&gt;&lt;pre&gt;&lt;code&gt;  bool malloc(size_t n, void **ptr) {
    *ptr = &amp;lt;memory&amp;gt;
  }

  void free(void **ptr) {
    ... &amp;lt;free&amp;gt;
    *ptr = NULL 
  }
&lt;/code&gt;&lt;/pre&gt;
This way, if anyone actually tries to use that pointer, it will crash the system (hardfault), instead of potentially using corrupted memory, which IMO is much worse.</text></item></parent_chain><comment><author>ffffjfjjfj</author><text>This gives a false sense of security, since the most common use-after-free bugs are if you kept a pointer around. Your method doesn&amp;#x27;t stop things like this:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    void *p1, *p2;
    malloc(100, &amp;amp;p1);
    p2 = p1;
    ...
    free(&amp;amp;p1);
    *p2; &amp;#x2F;&amp;#x2F; oops!
&lt;/code&gt;&lt;/pre&gt;
Obviously its trivial in an example like this, but when p2 leaves the lexical scope then there&amp;#x27;s a problem.</text></comment>