6 ms·

> or to making sure a large C program never overflows an addition Does Rust help with integer overflows? AFAIK it is as unsafe as C w.r.t. that.

the_mitsuhiko 4y ago
It has controllable behavior, explicit APIs to pick the precise behavior and there is no undefined behavior with regards to overflows which greatly helps with memory safety.
- zajio1am 4y ago
  It is controllable in real C compilers too (i.e. -fwrapv, -ftrapv GCC options), so you can make them silently ignored or cause trap. Real problem with integer overflows is that they are logic errors that are hard to check in compile-time, and neither C nor Rust helps with preventing them.
  - the_mitsuhiko 4y ago
    I’m not sure that’s true but I also don’t have data on this. In my personal experience the issue with integer over-/underflows mostly played a role when those integers were used in branching or memory indexing. The rules around UB with overflows are really messy and those issues definitely do not exist in Rust.
celrod 4y ago
It checks in debug mode, but these checks are turned off in release mode by default. They can be turned on in release mode, but C/C++ could add `-ftrapv` too[0]... You also have access to `checked_mul` and friends, so manually writing `i.checked_mul(j)` will add checks[1], without needing to use undocumented vendor specific builtins, like in C/C++[2]. [0] https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html [1] https://doc.rust-lang.org/std/primitive.u32.html#method.checked_mul https://doc.rust-lang.org/std/primitive.u32.html#method.chec... [2] https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins...
ekidd 4y ago
> Does Rust help with integer overflows? Overlow panics in debug mode. And in release mode, overflow is defined to wrap (2's complement) instead of invoking undefined behavior. One of the big dangers in C is "nasal demons", after all: https://en.wikipedia.org/wiki/Undefined_behavior https://en.wikipedia.org/wiki/Undefined_behavior But I've fuzzed a gnarly parser written in Rust, and actually found overflows. None of those overflows were exploitable (as more than a DDOS), because safe Rust also does bounds-checking on arrays and slices. Rust isn't perfect here. But in practice, it manages to mitigate almost everything anyways, because of boring ancient techniques like bounds checking. And the excellent fuzzing tooling makes it super easy to test parsers aggressively.
- erik_seaberg 4y ago
  My favorite analogy for “only debug builds check this” is wearing a floatation device at the dock but throwing it overboard to sail into a storm. Quiet overflow was sort of defensible on 4 MHz machines, but now Costco has desktops with a dozen cores each a thousand times faster. Moore’s law has more than paid for bounds checking and overflow exceptions (or even bignums) and we should be using them by default.
adgjlsfhk1 4y ago
the problem in C is that so much behavior is undefined which implies unreachable for the compiler. this means that C style UB can time travel, delete checks, delete whole functions and trash the world. rust (and most other languages) just define overflow to wrap which is way safer because you aren't letting the compiler mess with your code using assumptions that might be false.

the_mitsuhiko 4y ago

It has controllable behavior, explicit APIs to pick the precise behavior and there is no undefined behavior with regards to overflows which greatly helps with memory safety.

zajio1am 4y ago
It is controllable in real C compilers too (i.e. -fwrapv, -ftrapv GCC options), so you can make them silently ignored or cause trap. Real problem with integer overflows is that they are logic errors that are hard to check in compile-time, and neither C nor Rust helps with preventing them.
- the_mitsuhiko 4y ago
  I’m not sure that’s true but I also don’t have data on this. In my personal experience the issue with integer over-/underflows mostly played a role when those integers were used in branching or memory indexing. The rules around UB with overflows are really messy and those issues definitely do not exist in Rust.

celrod 4y ago

It checks in debug mode, but these checks are turned off in release mode by default. They can be turned on in release mode, but C/C++ could add `-ftrapv` too[0]... You also have access to `checked_mul` and friends, so manually writing `i.checked_mul(j)` will add checks[1], without needing to use undocumented vendor specific builtins, like in C/C++[2]. [0] https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html [1] https://doc.rust-lang.org/std/primitive.u32.html#method.checked_mul https://doc.rust-lang.org/std/primitive.u32.html#method.chec... [2] https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins...

ekidd 4y ago

> Does Rust help with integer overflows? Overlow panics in debug mode. And in release mode, overflow is defined to wrap (2's complement) instead of invoking undefined behavior. One of the big dangers in C is "nasal demons", after all: https://en.wikipedia.org/wiki/Undefined_behavior https://en.wikipedia.org/wiki/Undefined_behavior But I've fuzzed a gnarly parser written in Rust, and actually found overflows. None of those overflows were exploitable (as more than a DDOS), because safe Rust also does bounds-checking on arrays and slices. Rust isn't perfect here. But in practice, it manages to mitigate almost everything anyways, because of boring ancient techniques like bounds checking. And the excellent fuzzing tooling makes it super easy to test parsers aggressively.

erik_seaberg 4y ago
My favorite analogy for “only debug builds check this” is wearing a floatation device at the dock but throwing it overboard to sail into a storm. Quiet overflow was sort of defensible on 4 MHz machines, but now Costco has desktops with a dozen cores each a thousand times faster. Moore’s law has more than paid for bounds checking and overflow exceptions (or even bignums) and we should be using them by default.

adgjlsfhk1 4y ago

the problem in C is that so much behavior is undefined which implies unreachable for the compiler. this means that C style UB can time travel, delete checks, delete whole functions and trash the world. rust (and most other languages) just define overflow to wrap which is way safer because you aren't letting the compiler mess with your code using assumptions that might be false.