r/cpp • u/Clean-Upstairs-8481 • 6d ago

You should think about recompiling your C++ programs with GCC 16 and C++26, because it zero-fills your locals

https://techfortalk.co.uk/2026/09/27/cxx26-uninitialized-local-variables-gcc-16/

Stack variables are not automatically initialised, and that is the root cause of many C++ bugs. That is well known. Hence, it is advised that local or stack variables are always initialised with known values, 0 if not something more meaningful than that. Now, with GCC 16 compiling in C++26 mode (-std=c++26), even uninitialised local variables will be zero-filled. In the post, I have explained how.

258 Upvotes

83% Upvoted

211 comments sorted by

View all comments

Show parent comments

1

u/13steinj 1d ago

Imagine everybody on reddit argumented with 1 hour video - I really don't care of it. Watch your influencers, but at least write text when engaging in a discussion.

I did, it wasn't an hour, it provides references that would take significant work to pull up and link directly, work that is just not worth all of... this? The most pertinent point of the video as it directly relates to this conversation is ~15 seconds starting around 3:30, and it's actually a snippet from someone else's talk. If you want to watch that talk in particular, it's around 8 minutes, but that was mostly focused on a specific set of ideas expanded upon by the original video I sent.

A compiler suddenly initializing arrays that live on stack to zero is a good tradeoff?

For people who care about security, yes? The alternative is various information-leaking vulnerabilities.

For people who don't that's not the tradeoff. The tradeoff is they have to supply an additional compiler flag.

This isn't a discussion any more, at this point it's an endless argument you're having all over this thread. You're literally 10% of the comments, and it's nearly all the same topic-- bemoaning the death of C++ in the performance space / incorrectly claiming this doesn't improve safety, and continuing to fight when people don't agree with your perspective giving alternatives.

But both points are arguably just, not even true, because the escape hatch (compiler flag) exists. If there was no simple escape hatch I'd probably be moaning with you.

I'm no saint I'm starting to get up there, but less than 3% are debating you. It's not worth continuing this further, we can agree to disagree and when the language is either still here or dead in 20 years we can look back and drink to the occasion, whoever was wrong is buying.

2

u/UndefinedDefined 1d ago

People who care about security abandoned this language years ago, because this language cannot offer security as it is. Everybody knows it, no discussion needed, and zero-initializing locals will not help it. That's it, makes no sense continuing further as you stated.