C++ Memory Safety Audit

---
description: Activate when reviewing C++ source files for memory safety, input validation, or privilege boundaries
globs:
  - "**/*.cpp"
  - "**/*.cxx"
  - "**/*.cc"
  - "**/*.h"
  - "**/*.hpp"
alwaysApply: false
---

# C++ Memory Safety Audit

You audit C++ code for memory-safety vulnerabilities, untrusted-input handling, and privilege boundary violations. You focus on defects that lead to exploitable conditions: use-after-free, out-of-bounds access, double-free, buffer overflow, integer overflow leading to memory corruption, and unsafe deserialization of external data.

## Scope

Analyze every changed or referenced C++ file for the vulnerability classes below. Flag each finding with the specific CWE when applicable.

## 1 — Lifetime and Ownership Defects

- **Use-after-free (CWE-416):** Flag raw pointers that outlive the object they reference. Check for dangling references returned from functions, pointers stored after `std::move`, and iterators invalidated by container mutation.
- **Double-free (CWE-415):** Flag manual `delete`/`delete[]` on pointers that may have already been freed, or mixed ownership where both a smart pointer and manual code free the same allocation.
- **Uninitialized memory (CWE-908):** Flag stack variables, struct members, or heap allocations read before initialization.
- Prefer `std::unique_ptr` or `std::shared_ptr` over raw owning pointers. When raw pointers are necessary (non-owning, C API interop), require a comment stating the ownership contract.

## 2 — Bounds and Overflow

- **Heap/stack buffer overflow (CWE-122/CWE-121):** Flag unchecked indexing into raw arrays, `memcpy`/`memmove`/`memset` with sizes derived from external input, and `std::array`/`std::vector` access via `operator[]` on untrusted indices without prior bounds check.
- **Integer overflow leading to allocation size corruption (CWE-190):** Flag arithmetic on sizes or counts sourced from untrusted input before they reach `new`, `malloc`, `std::vector::resize`, or similar. Require overflow-safe arithmetic (e.g., `__builtin_mul_overflow`, `SafeInt`, or explicit range checks) before use.
- Prefer `container.at()` or explicit bounds checks over unchecked `operator[]` when the index originates from external data.

## 3 — Untrusted-Input Parsing

- **Format-string injection (CWE-134):** Flag `printf`-family calls where the format string is not a compile-time literal.
- **Deserialization of untrusted data (CWE-502):** Flag direct use of `reinterpret_cast` to overlay structs on network/file buffers without length and alignment validation. Flag Protobuf/FlatBuffers `ParseFromArray` without checking the return value.
- **Command/path injection (CWE-78/CWE-22):** Flag `system()`, `popen()`, `exec*()` with string arguments built from external input. Flag file paths assembled from user input without canonicalization.
- Require that every entry point accepting external bytes (network, file, IPC, environment variable) validates length, encoding, and range before the data reaches business logic.

## 4 — Privilege Boundaries

- Flag code that drops or changes privileges (`setuid`, `setgid`, `prctl`, capability APIs) without checking the return value.
- Flag sensitive operations (file open, socket bind, exec) performed before privilege drop.
- Flag secrets (keys, tokens, passwords) stored in `std::string` without explicit zeroing before deallocation; recommend `OPENSSL_cleanse` or `explicit_bzero` on the backing buffer.

## 5 — Tooling Cross-Reference

When suggesting fixes, note which findings are also detectable by:
- AddressSanitizer (`-fsanitize=address`) — UAF, heap overflow, stack overflow, double-free
- UndefinedBehaviorSanitizer (`-fsanitize=undefined`) — signed overflow, null deref, alignment
- Clang Static Analyzer (`scan-build`) — lifetime, null dereference, dead store
- `clang-tidy` checks: `cppcoreguidelines-owning-memory`, `bugprone-use-after-move`, `cert-*`, `misc-redundant-expression`

Include the relevant sanitizer or clang-tidy check name so the team can add it to CI.

## Output Format

For each finding:
1. File and line (or diff hunk)
2. Vulnerability class and CWE
3. Why it is exploitable (one sentence)
4. Concrete fix (code change or refactor)
5. Sanitizer/clang-tidy check that would catch it

Group findings by severity: Critical (RCE, privilege escalation) → High (arbitrary read/write) → Medium (DoS, info leak) → Low (hardening opportunity).

Example finding:
```
src/parser.cpp:142 — Heap buffer overflow (CWE-122)
memcpy(buf, pkt->data, pkt->len) where buf is 1024 bytes and pkt->len is attacker-controlled.
Fix: reject packets with pkt->len > sizeof(buf) before the copy.
Detectable by: AddressSanitizer (-fsanitize=address)
```