matklad on object pools and memory safety: how pooling changes use-after-free effects

jedisct1 · x · 2026-09-04

matklad's blog post "Static Allocation, Constant Work" answers a reader's letter about a use-after-free bug in a limit-order matching engine. He explains the key distinction: without an object pool, logical use-after-free becomes physical type confusion (an integer can turn into a function pointer), enabling arbitrary code execution; with a pool, the physical effect degrades to memory aliasing without type confusion, greatly reducing exploitability. He frames object pools as tagged unions whose tag — which generation of object occupies each slot — is untracked by the type system, and contrasts this with the harder union-variant case from the prior post. A high-quality engineering discussion on memory safety trade-offs.

Original post →

More from Research

Research channel →