5 ms·
How would using Rust help this case? An out of bounds array would still lead to a crash, and thus a DoS in the crashing application. You could sandbox the text
by gok 9y ago
How would using Rust help this case? An out of bounds array would still lead to a crash, and thus a DoS in the crashing application. You could sandbox the text rendering into its own process to solve that, but then you could do that using unsafe languages anyway.
- tomjakubowski 9y agoRust would significantly help to prevent the escalation of this crash into an RCE.
- GirlsCanCode 9y agoThe Rust zealots are awake!
- mrob 9y agoFully sandboxing an unsafe renderer might have unacceptable performance. E.g. you'd have to reset the internal state after every call, otherwise invalid text on a phishing website might be able to subvert the renderer to make it render text in the URL bar to read something different.
- dom96 9y agoWouldn't any language with exceptions work here? You just define an indexing operator that throws an exception instead of crashing and handle that exception outside the unicode handling function.
- thezoq2 9y agoThe advantage of rusts error handling is that it is explicit. The compiler knows that a function might result in an error and forces the programmer to deal with it, or pass it along. In an exception based language you might forget to deal with the error and have it crash "higher up" in the code. I also suspect that there might be a performance benefit but I could be completely wrong about that
- m0th87 9y ago> The advantage of rusts error handling is that it is explicit. The compiler knows that a function might result in an error and forces the programmer to deal with it, or pass it along. Checked exceptions are explicit as well, though I'm not aware of a language that _only_ has checked exceptions. > I also suspect that there might be a performance benefit but I could be completely wrong about that Yes, this is a big advantage. Stack unwinding is very expensive.
- peoplewindow 9y agoIt's actually slower to not use exceptions and what you describe is not an advantage - exceptions also force you to deal with it or pass it along, if the exception is checked. Bounds check failures aren't of course because that would be incredibly inconvenient and unwieldy, and anyway, you'd just pass it all the way up the stack to some much higher level point which is the only place you can sanely do something (like not render the string at all).
- thezoq2 9y agoAn out of bounds access doesn't have to lead to a crash. For most types in the standard library, the [] operator crashes but the "get" function returns Result<T, E> which you can deal with.
- beojan 9y agoSo it's really no better than C++, where containers have a `.at` function that does bounds-checking and throws an exception if out of bounds.
- cesarb 9y agoThe difference is that on Rust the [] operator does bounds checking: it'll reliably panic before accessing memory if the index is out of bounds. While on C++, the [] operator will happily let the program read or write outside the array bounds. Depending on compile-time options, a Rust panic can either cause an immediate crash, or do something similar to throwing a C++ exception, complete with stack unwinding.
- Manishearth 9y agoYeah, and because it's reliable, you don't need to worry about security issues -- the worst this can do is abort the application. Whereas for this bug it's quite possible that it may be exploitable. Especially given that the crash backtrace doesn't always appear in the same place -- something is corrupting memory that gets discovered later. (This explains why I can sometimes get the string to render for a split second before crashing)