4 ms·
Half the point of Rust is to drive the amount of unsafe code as close to zero as possible so we don't have to worry about crap like that. Based on the code I'v
by koverstreet 9y ago
Half the point of Rust is to drive the amount of unsafe code as close to zero as possible so we don't have to worry about crap like that.
Based on the code I've seen, I think you're simply protecting your experiences and fears from C++. You are of course free to use an allocator that zeroes on dealloc in your own code.
- Yoric 9y agoTo be fair, Rust code can link to (entirely unsafe) C/C++ code or even JIT-compiled code, in which case you also want some runtime guarantees to mitigate exploits in case they happen. In such a case, I believe a clearing allocator (or a set of custom allocators) sounds like the way to go. There may be a performance penalty, but you will be certain that all instances are covered, not just Vec<_>. Alternatively, a typed allocator (I wanted to link to a paper on the topic, but I can't find it) can, for a very small price, perform reasonably good mitigation on such exploits.