JTC 1/SC 22/WG 23 C++ Vulnerability Discussions    WG 23 N1579
		July 20 2026
		

Participants
    Stephen Michell - convenor, SCC
    Peter Sommerlad - Switzerland
    Matt Butler - USA
    Richard Corden - Spain
 
 Regrets
    Erhard Ploedereder - liaison
    Loic Joly - AFNOR
    Paul Preny - Canada

    
Actions:


Issues addressed:

       Raised issue #235 to rename filename for clause 4.3.


       #230 4.3 ODR Need to talk about ODR
       closed after edits to 4.3.

       #11 Define unchecked (random) access in clause 3 (or 4)
       closed - addressed as part of other issues

       

       #46 closed - overtaken by events

       #54 closed - overtaken by events

       #55 Add guidance from 6.47.2 to Core guidelines
       Closed, We are not  attempting to change Core Guidelines.

       #80 Add a new discussion to clause 4 Language Concepts
       Closed - Clause 4 populated from other issues.

       #85  insert definition of _potentially dangling type_ and _potentially dangling object_
       Completed

       #11  Define unchecked (random) access in clause 3 or explain C++ approach in clause 4
        Closed - current material is sufficient 

       #24 - 6.63 Protocol lock errors
       Material was written for other issues in 6.63.
       
       #232 Issue with unqualified name lookup
       Resolve with correction to 4.3 

       #233 add different compiler version problems with ODR violations to corresponding library rule
       Closed - ODR has been addressed

       


Clauses addressed:

Every clause was edited by editor since the 6 July 2024 meeting to correct references to ISO/IEC 24772-1:2024
and ISO/IEC TR 24772-3:2020.
Requires review.

6.47 Inter-language calling - included statement of potential violations of the one-definition rule (ODR) ODR. 

6.49 Library signature - added guidance to ensure interoperability with C-header files.

4.3 Symbol lookup and overload resolution

4.5 Initialization - added ???

6.13 - removed obsolete reference.

6.21 - Namespace issues - moved some explanation to 4.3 and removed example of overload resolution with default argument.

6.20 - Identifier name reuse - realized that there is no vulnerability associated with "overload resolution" so restructured 6.20 and 6.21 to give sufficient coverage of overload resolution in 6.21.
    

6.21 Namespace issues
     Included One definition rule (ODR) concepts.
     Rewrote  guidance to include ODR preference and late name changes 
     


All work is done on GitHub in the folder for ISO-IEC-JTC1-SC22-WG23-CPP. Please contact
stephen.michell@maurya.on.ca for access.



FROM THE CHAT 2026-07-20:
Richard Corden (Jul 20, 2026, 12:48 PM)
https://en.cppreference.com/cpp/language/lambda
A lambda expression can use a variable without capturing it if the variable
is a non-local variable or has static or thread local storage duration (in which case the variable cannot be captured), or
is a reference that has been initialized with a constant expression.
A lambda expression can read the value of a variable without capturing it if the variable
has const non-volatile integral or enumeration type and has been initialized with a constant expression, or
is constexpr and has no mutable members.