Hacker News new | ask | show | jobs
by ddevault 1967 days ago
It's actually within spec, in this case. Still reasonable?
1 comments
gpm 1967 days ago
It's within the C and systemv abi specs, but it's not within the implicit contract of how you call command line programs. I'm fine with it.
link
ddevault 1967 days ago
Right, but if it was within the specs, possible to craft a scenario for, and leads to a security vulnerability, then does it suddenly matter? A bug is a bug. If it doesn't matter for Rust then it doesn't matter for C.
link
gpm 1967 days ago
> and leads to a security vulnerability

I have trouble imagining how aborting leads to a security vulnerability? That's literally running no code, the opposite of running arbitrary code.

Aborting is fine in any language. Criticisms of C here would come about because C doesn't abort when it should (null pointer deref, array out of bounds, etc), not the inverse.

link