2 ms·
> the exploits are impossible to write by accident, but they are possible to write on purpose. Can you give some examples? What ways are there to write safe ru
by josephg 2y ago
> the exploits are impossible to write by accident, but they are possible to write on purpose.
Can you give some examples? What ways are there to write safe rust code & do nasty things, affecting other parts of the binary?
Is there any reason bugs like this in LLVM / rustc couldn't be, simply, fixed as they're found?
- steveklabnik 2y agohttps://github.com/Speykious/cve-rs https://github.com/Speykious/cve-rs They can be fixed, but as always, there’s a lot of work to do. The bug that the above package relies on has never been seen in the wild, only from handcrafted code to invoke it, and so is less of a priority than other things. And some fixes are harder than others. If a fix is going to be a lot of work, but is very obscure, it’s likely to exist for a long time.
- josephg 2y agoYes, true. But as others have said, there’s probably still some value in making authors of malicious code jump through hoops, even if it will take some time to fix all these bugs. And the bugs should simply get fixed.