3 ms·

Panicking can be leveraged for a DoS attack. Use after free can be leveraged for arbitrary code execution.

• menaerus 3y ago
  How about exceptions?
  • deleted 3y ago
    [deleted]
  • estebank 3y ago
    Panics are implemented in the same way as exceptions are in C++, beyond that Rust doesn't have a concept of exceptions at all. Fallibility is expressed in terms of sum types that signal state for success or failure with Result.
    • menaerus 3y ago
      > Panics are implemented in the same way as exceptions are in C++ If this is true or at least fundamentally very close to each other, and given that exceptions can be abused for arbitrary code execution [1] [2], then it follows that Rust is no different/safer with respect to that, no? [1] https://billdemirkapi.me/exception-oriented-programming-abusing-exceptions-for-code-execution-part-1 https://billdemirkapi.me/exception-oriented-programming-abus... [2] https://billdemirkapi.me/abusing-exceptions-for-code-execution-part-2 https://billdemirkapi.me/abusing-exceptions-for-code-executi...