Hacker News new | ask | show | jobs
by ddffre 2592 days ago
Were the major security vulnerabilities fixed?

I remember all the talking while back about the major bugs regarding the language.

1 comments

Short answer: yes

Long answer: it depends whether you mean actual vulnerabilities, or soundness bugs

Known bugs that could affect security of programs written in Rust get fixed ASAP. There was one serious bug in std's VecDeque that caused memory corruption. There was a more recent issue where if you override type_id method that wasn't supposed to be overridden, and then use another method that relies on type_id being correct, you get crashy garbage. In C or C++ that'd be called garbage-in, garbage-out, and a bad programmer shooting themselves in the foot. In Rust that was considered a vulnerability.

Apart from that, there are known soundness bugs in the language/compiler/LLVM that could lead to undefined behavior, miscompilation, or otherwise weasel out of things that the language is meant to guarantee:

https://github.com/rust-lang/rust/issues?q=is%3Aopen+is%3Ais...

At this point these are mostly edge cases that you're unlikely to hit in real code, but if you really really want to make your program crash, Rust can't stop you.