3 ms·
If I remember correctly, rust compiles to static binaries by default, meaning they include a copy of all used parts of both libraries and standard library in th
by perlgeek 5y ago
If I remember correctly, rust compiles to static binaries by default, meaning they include a copy of all used parts of both libraries and standard library in the executable.
Does that mean that any Rust program compiled with any affected version of the standard library is affected? How would I even find those?
Statically linked binary make deployments really easy, but this one scenario where they have real downsides.
- kam 5y ago> Does that mean that any Rust program compiled with any affected version of the standard library is affected? Most programs don't use `remove_dir_all`, and a smaller fraction of those use it on a directory that untrusted actors can write to. But yes, tracking down those that do is a challenge.
- pornel 5y agoThe bug exists in all versions of libstd before today's, so in this case finding possibly affected Rust programs is easy: all of them. As for other situations: when Rust programs are built with Cargo, it creates a Cargo.lock file, which is a machine-readable record of all dependencies and their checksums used in the build. Distros could archive it and later use it track all affected dependencies. Unfortunately, libstd is a magical compiler built-in, not a regular dependency, so it doesn't get recorded that way.
- perlgeek 5y agoHow do I find out if an executable was built with rust? (Assuming it's not my code...)