How memory safety CVEs differ between Rust and C/C++

Post by vintagedave » Mon, Jun 15, 2026, 10:17 PM UTC

hathawsh wrote: post #34

cesaref wrote: post #29

Is it only me that would have expected curl_getenv() to have an assert that it's argument isn't NULL? I know this doesn't stop runtime problems in release builds, but i'd have thought this sort of simple precondition check would help users find problems in their library useage. It's not going to stop you passing a non-terminated string, or other such invalid input though, which is I guess more the point, that it's to…

If I were doing a code review, I would probably accept the code either with or without the assertion. The context of curl_getenv() makes it clear that null is not acceptable. If the author of curl_getenv() had evidence that callers are frequently breaking the contract by passing null, then perhaps the assertion would help shed some light on violators. Otherwise, I would expect everyone to play by the rules, making th…

Post by cfdryhh » Mon, Jun 15, 2026, 10:28 PM UTC

john_strinlai wrote: post #42

> Because sometimes I see people online who compare the number of CVEs in Rust and C/C++ software, [...] a rule of thumb i follow is that the second someone starts comparing or talking about the number of CVEs, i just ignore whatever they say next. its hard to think of a more useless metric than "number of CVEs", especially now. (edit: the people disagreeing are encouraged to share how you use "number of CVEs" to inf…

Post by dralley » Mon, Jun 15, 2026, 10:52 PM UTC

bitbasher wrote: post #83

tcfhgj wrote: post #77

Earlier quoted context omitted.

I think none of this is special to Rust vs C++, except #4, because C++ doesn't have an equivalent

Most dependencies in the C/C++ world come with fewer dependencies of their own (at least, an order of magnitude fewer than the average rust dependency). Perhaps a Makefile could be considered arbitrary code execution, but we've been running Makefiles for 50 years and we haven't had the supply chain issues we see in NPM, etc. Supply chain risk was always considered in the C/C++ world... think back to Ken Thompson's 19…

Post by IcyWindows » Mon, Jun 15, 2026, 11:14 PM UTC

Groxx wrote: post #10

chilljinx wrote: post #3

Unsafe is not necessary to trigger UB in case no_std is used. Nor if one of the soundness holes in the Rust programming language itself is encountered. Nor if there is UB in one of the libraries used as a dependency by the library you are using. Nor if there is UB in the Rust standard library. Which has happened many times, since the Rust standard library is full of unsafe. Rust also requires libraries to be safe reg…

I'm caught somewhere between interpreting this as "C is all we need. git gud" and "rust hurt me and I'm still mad" and I'm struggling to see any other option. It's an unfocused rant that seems keyed off "rust" and little else. In broad strokes it's correct, this stuff happens and it's hard to be correct all the time. But are you trying to make a point? Or just ranting? Also that linked issue was considered a CVE and…

Post by Dylan16807 » Mon, Jun 15, 2026, 11:41 PM UTC

jstimpfle wrote: post #108

dwattttt wrote: post #104

Earlier quoted context omitted.

An assertion is an app crashing on a violation. The problem is when it's not guaranteed to crash, and instead does something very wrong.

A bug is a bug even when it doesn't clearly manifest itself 100% of the time, and furthermore it is pretty much guaranteed that NULL dereference crashes with segfault in practice, only not for the people playing theoretic games whose essence of life is finding gotchas where it maybe isn't so and then feeling smarter than everyone else. But it's >> 99.9% true that this will just crash even though it's acshually UB, na…