Skip to content

Clarify properties of memory safety in .NET programs #375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jkotas merged 7 commits into from
Oct 7, 2026
Merged

Clarify properties of memory safety in .NET programs #375

Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3a8a39c
Clarify properties of memory safety in .NET programs
agocke Sep 15, 2026
00faad4
Update caller-unsafe.md
agocke Sep 18, 2026
776fad6
Define requirements for managed references in unsafe code
agocke Sep 18, 2026
9270c8d
Update managed references requirements in caller-unsafe.md
agocke Sep 18, 2026
0a9bd6c
Update managed references requirements for safety
agocke Sep 19, 2026
75d4d80
Clarify managed references requirements in documentation
agocke Sep 19, 2026
3eadb92
Apply suggestion from @jkotas
agocke Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion accepted/2025/memory-safety/caller-unsafe.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,10 +114,11 @@ public sealed class RequiresUnsafeAttribute : System.Attribute

### Global invariants

Two properties which should always hold in .NET programs are:
Properties which should always hold in .NET programs are:

* Memory safety
* No access to uninitialized memory
* Managed references are either null, or always valid to dereference, both as references and if converted to a pointer of the same type

@jkotas jkotas Sep 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is valid for a managed reference to point to the end of the array. It is valid unsafe use of managed references.

https://github.com/dotnet/runtime/blob/main/docs/design/specs/Ecma-335-Augments.md goes into detail about this. (look for "Managed pointers which point at the address just past the end of an object, or the address where an element just past the end of an array would be stored, are permitted but not dereferenceable.")

@agocke agocke Sep 18, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, managed references are particularly weird in that they have separate rules for safe code and unsafe code:

  1. Some things are valid everywhere (normal managed references created by safe APIs).
  2. Some thigns are only valid in unsafe code (unaligned managed references).
  3. Some things are never valid (managed references pointing to invalid memory).


The "safe" subset of C# must guarantee these properties by construction. The unsafe subset cannot be guaranteed entirely by the system -- it needs external validation by the user or other tooling.

Expand Down
Loading