memory safety

term

programmingsecurity

The property of never accessing memory outside what a program legitimately owns, in space or in time.

Two halves: spatial safety means staying inside an object's bounds, and temporal safety means only touching it while it is alive, which is why buffer overflows and use-after-free are the same problem viewed on different axes. The industry conclusion, stated by CISA, the NSA, and Microsoft alike, is that roughly seventy percent of serious vulnerabilities in large C and C++ codebases are memory-safety bugs, which is what put Rust, Go, Java, and modern C++ practice at the center of the conversation. Rewriting everything is not realistic, so the practical answer is memory-safe languages for new components plus hardening and sanitizers for the code that stays.

Also known as: memory-safe language, spatial safety, temporal safety

All glossary entries