4 ms·

https://github.com/Speykious/cve-rs https://github.com/Speykious/cve-rs

• ultimaweapon 2y ago
  You are very unlikely to hit this bug in a real world Rust project while C/C++ you can easily hit by a memory safety bug.
  • weinzierl 2y ago
    Exactly, and also MIRI catches all of these, so with a tiny little extra effort world is in order again. Moreover, if I remember correctly, they all are made possible by a single (long-standing) compiler bug that eventually will be fixed. Previously discussed: https://news.ycombinator.com/item?id=39440808 https://news.ycombinator.com/item?id=39440808 I think this mindset is the big difference. We're not perfect, but we're working on it.
    • zyedidia 2y ago
      The bug used by that repository [1] isn't the only one that can be used to escape the Safe Rust type system. There are a couple others I've tried [2] [3], and the Rust issue tracker currently lists 92 unsoundness bugs (though only some of them are general-purpose escapes), and that's only the ones we know about. These bugs are not really a problem in practice though as long as the developer is not malicious. However, they are a problem for supply chain security or any case where the Rust source is fully untrusted. [1]: https://github.com/rust-lang/rust/issues/25860 https://github.com/rust-lang/rust/issues/25860 [2]: https://github.com/rust-lang/rust/issues/57893 https://github.com/rust-lang/rust/issues/57893 [3]: https://github.com/rust-lang/rust/issues/133361 https://github.com/rust-lang/rust/issues/133361