3 ms·
> Does Rust help with integer overflows? Overlow panics in debug mode. And in release mode, overflow is defined to wrap (2's complement) instead of invoking un
by ekidd 4y ago
> Does Rust help with integer overflows?
Overlow panics in debug mode. And in release mode, overflow is defined to wrap (2's complement) instead of invoking undefined behavior. One of the big dangers in C is "nasal demons", after all: https://en.wikipedia.org/wiki/Undefined_behavior https://en.wikipedia.org/wiki/Undefined_behavior
But I've fuzzed a gnarly parser written in Rust, and actually found overflows. None of those overflows were exploitable (as more than a DDOS), because safe Rust also does bounds-checking on arrays and slices.
Rust isn't perfect here. But in practice, it manages to mitigate almost everything anyways, because of boring ancient techniques like bounds checking. And the excellent fuzzing tooling makes it super easy to test parsers aggressively.
- erik_seaberg 4y agoMy favorite analogy for “only debug builds check this” is wearing a floatation device at the dock but throwing it overboard to sail into a storm. Quiet overflow was sort of defensible on 4 MHz machines, but now Costco has desktops with a dozen cores each a thousand times faster. Moore’s law has more than paid for bounds checking and overflow exceptions (or even bignums) and we should be using them by default.