alt Hacker NewsMemory Safety Bugs in Rust Standard Library
Comments
I've always felt that parts of the Rust standard library to be weirdly un-rusty. Like indexing a vector panicking instead of returning a Some(T) in case the index is out of bounds. It's easy to avoid if you put the effort in of course, but it did always feel weird that one of the first data structures you learn has this behavior right out of the gate.
> Pattern 2: Trusting user-provided implementations to be correct
reminds me of the tales from https://oxide.computer/blog/iddqd-unsafe
> Notes from Microsoft Security's Frontier Offensive Research & Generative Exploitation Lab.
> But many operations in Rust can panic, from out-of-bounds indexing to calls into user-provided code, and by default a panic unwinds
That's why I think having unwinding in Rust is a mistake. It gives a false sense of safety, but it's very hard to write unwinding-correct code. So, it would be better to handle panics as immediate process termination instead.
I sure wish they'd rewrite the Azure Linux VM Agent in Rust. That thing normally burns 10-15% of a core, and also blocks VM restart for tens of minutes, god knows why.
[flagged]
[dead]
Just because emotions seem to be always boiling whenever Rust is mentioned, I want to clarify for people who only follow casually that there is nothing unusual or scandalous about these finds.
The Rust project as a whole currently has 178 open issues with the tag I-unsound[1]. Many of these describe issues that only exist in the nightly compiler, of course, but it does happen that bugs are not caught before shipping. That's software.
[1]: https://github.com/rust-lang/rust/issues?q=is%3Aissue+state%...