logoalt Hacker News

cowlevel • today at 12:57 AM • 3 replies • view on HN

The bug is integer overflow in a random C data-processing library (specifically regexes) leading to RCE.

Who else is tired of C libraries since this week?


Replies

ferrisjoke • today at 2:37 AM

I've heard the joke many times, but I didn't expect that even programming would ever end up wanting to evolve to crabs.

Gigachad • today at 12:59 AM

I've been calling this out for forever now and have been repeatedly told that actually, competent devs with C are fine and the C software we use has been battle tested so it's largely secure.

And now we are seeing that was all untrue.

➕ show 2 replies
grg0 • today at 2:07 AM

And how does Rust help? As far as I know, an integer overflow in Rust panics in debug but just wraps in release (a bad choice in my opinion). Would it help specifically in the code execution part of the exploit?

➕ show 1 reply