Memory Safety

Memory safety is a concern in software development that aims to avoid software bugs that cause security vulnerabilities dealing with random-access memory (RAM) access, such as buffer overflows and dangling pointers.

Computer languages such as C and C++ that support arbitrary pointer arithmetic, casting, and deallocation are typically not memory safe. There are several different approaches to find errors in such languages: see the Detection section below.

The Cyclone language uses a hybrid approach, including "fat pointers" (pointers that carry their metadata directly) and regions to give programmers some low-level control while still ensuring memory safety.

Most high-level programming languages avoid the problem by disallowing pointer arithmetic and casting entirely, and by enforcing tracing garbage collection as the sole memory management scheme.

A language could support even more uses of pointer arithmetic, casting, and deallocation without sacrificing memory safety by using automated theorem proving as a form of static code analysis. ESC/Java and D demonstrate two ways that programmers can declare their invariants in ways that can be understood by a theorem prover.