3 ms·
Aye, I agree. But if we consider that case, a similar mistake could be made: hard-coding argv[0]. The result is different, in that the program just aborts, but
by ddevault 6y ago
Aye, I agree. But if we consider that case, a similar mistake could be made: hard-coding argv[0]. The result is different, in that the program just aborts, but it's still the Wrong Thing To Do, and in both cases it never leads to anything exploitable. Bugs are bugs, no matter what language. We could come up with examples all day. Just head to your nearest Rust program's bug tracker :)
- gpm 6y agoAborting when argv[0] doesn't exist... is a perfectly reasonable thing to do? Someone called the program with arguments severely out of spec, crashing is fine.
- ddevault 6y agoIt's actually within spec, in this case. Still reasonable?
- gpm 6y agoIt's within the C and systemv abi specs, but it's not within the implicit contract of how you call command line programs. I'm fine with it.
- ddevault 6y agoRight, but if it was within the specs, possible to craft a scenario for, and leads to a security vulnerability, then does it suddenly matter? A bug is a bug. If it doesn't matter for Rust then it doesn't matter for C.
- gpm 6y ago> and leads to a security vulnerability I have trouble imagining how aborting leads to a security vulnerability? That's literally running no code, the opposite of running arbitrary code. Aborting is fine in any language. Criticisms of C here would come about because C doesn't abort when it should (null pointer deref, array out of bounds, etc), not the inverse.