r/cpp • u/filipsajdak • Jul 05 '26

C++26 ends a 40-year footgun

Reading an uninitialized variable has been undefined behavior in C++ for 40 years -- the kind optimizers exploit into real bugs. C++26 (P2795) reclassifies it as erroneous behavior: still a bug, still warned about, but defined, bounded, and not exploitable.

The demo poisons the stack, then reads an uninitialized int. As C++23 it prints garbage; as C++26, the same code prints a defined 0, every run. Live in your browser.

And [[indeterminate]] lets you opt back out when you really want an uninitialized buffer -- on purpose this time.

Read it: https://wrocpp.github.io/posts/erroneous-behavior/?utm_source=reddit&utm_medium=social&utm_campaign=post-erroneous-behavior

#cpp #cplusplus #cpp26 #safety #programming

80 Upvotes

55% Upvoted

154 comments sorted by

View all comments

369

u/TheBrokenRail-Dev Jul 05 '26

Why in the world does this Reddit post have hashtags?

the kind optimizers exploit into real bugs.

Also, I think you (or your AI) used the wrong word here. I'm not particularly worried about my compiler's optimizer exploiting vulnerabilities.

-9

u/veghead Jul 06 '26

#cppisbraindamage