> In contrast, Puffs today performs as fast as C, with arithmetic overflow checks. They just happen to be compile time checks. I'll grant that's largely true,

> In contrast, Puffs today performs as fast as C, with arithmetic overflow checks. They just happen to be compile time checks. I'll grant that's largely true, but as far as I can see it's not entirely true. For example, to quote a comment from one of the example .puffs files: // Set history_index (modulo 0x8000) to the length of this // remainder. The &0x7FFF is redundant, but proves to the // compiler that the conversion to u32 will not overflow. In this case, the redundant operation is equivalent to a disabled arithmetic overflow check, although it's (commendably) made more explicit. Similarly, in decode_lzw.puffs, I think (could be wrong) that some of the conditions in 'if' statements, e.g. "(width < 12)", should always be true unless the image is malformed. In a way, this is substituting for a runtime array bounds check and/or overflow check that might be hit if the condition weren't present. Here too, Puffs arguably wins by making the check explicit. If I'm right that the author stuffed in extra conditions where demanded by the compiler, rather than properly considering the consequences of their being false (e.g. should probably result in returning an error), then there's some argument that it would be better to crash than silently misbehave. But even then, at least Puffs makes the problem relatively obvious, whereas in e.g. Rust you just have to trust that your code won't perform any overflows. > And sometimes overflow is indeed a concern (search for "underflow" in https://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1.... https://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1....). Integer overflow is a huge concern in C, but much less of one in memory-safe languages, where a buffer size being miscalculated should result in a controlled panic rather than memory corruption (…at least if you're not interfacing with unsafe code). Still, an overflow is effectively a miscalculation, incorrect behavior, and with any kind of incorrect behavior there's always a chance it will compromise security in some way.