How memory safety CVEs differ between Rust and C/C++

Post by uecker » Tue, Jun 16, 2026, 4:03 PM UTC

Ygg2 wrote: post #219

uecker wrote: post #209

Earlier quoted context omitted.

A major global internet outage can certainly considered a "clear signal". Still not sure this was a good thing though.

It's not an ideal thing for sure, but between loud bang and silent corruption, I'd probably take loud bang. I.e. I'll take a panic rather than the method return 43 when you pop the null member from the stack. And the Rust wasn't the root cause but corrupt configs were being erroneusly duplicated.

Post by pjmlp » Tue, Jun 16, 2026, 4:41 PM UTC

saghm wrote: post #213

pjmlp wrote: post #210

Earlier quoted context omitted.

The recipe is tame C and C++ as much as possible, on the language level, toolchains and hardware memory tagging, following by writing new code in something else like Swift. See Meet with Apple, security event. Naturally they aren't going to throw away LLVM, DriverKit or Metal Shading Language, so there is a compromise there.

My point is that there are plenty of smart people touting various recipes for safe C++, but somehow vanishingly few instances of actually safe C++ codebases. It's hard not to feel like the claims that C++ can be made safe are mostly being made from an abstract theoretical viewpoint and not a pragmatic one, because even the companies with the most resources or the smartest people don't seem to be able to pull it off.

Post by wahern » Tue, Jun 16, 2026, 6:05 PM UTC

saghm wrote: post #149

f33d5173 wrote: post #93

Earlier quoted context omitted.

$ gcc -Wall -Werror -x c - :1:37: error: null passed to a callee that requires a non-null argument [-Werror,-Wnonnull] 1 | void f(int x[static 1]){}int main(){f(0);} | ^ ~ :1:12: note: callee declares array parameter as static here 1 | void f(int x[static 1]){}int main(){f(0);} | ^~~~~~~~~~~ 1 error generated. It can be done, though it usually isn't.

Can you do that with a dynamic array? If not, it's pretty severely limited (unless you mean that literally forbidding dynamic memory is usually not done, which I guess it's true outside of some embedded code but not a particularly meaningful statement).

  #include 
  
  #if __has_include()
  #include 
  #else
  #define countof(a) (sizeof (a) / sizeof *(a))
  #endif
  
  void
  foo(int n, int a[static 1][n])
  {
   printf("sizeof *a: %zu\n", sizeof *a);
   printf("countof *a: %zu\n", countof(*a));
  }
  
  int
  main(int argc, char *argv[])
  {
   int array[argc];
   foo(countof(array), &array);
   return 0;
  }

  $ ./foo                            
  sizeof *a: 4
  countof *a: 1
  $ ./foo 2 3
  sizeof *a: 12
  countof *a: 3

Post by tialaramex » Tue, Jun 16, 2026, 7:34 PM UTC

tptacek wrote: post #216

tialaramex wrote: post #211

Earlier quoted context omitted.

I've met good auditors. I mean, I've met terrible auditors too, but the good ones stick in my mind more because they ask insightful questions about my software or sometimes software in general. It's a problem that this is often seen as a box ticking exercise, done right it can be a really great opportunity to improve but so often instead the priority is to get the paperwork done and too bad if you achieved nothing by…

If we're talking about actual auditors, not tech consultants who call themselves auditors but people actually trained as auditors, I'd take it as a bad sign if they asked a bunch of specific unbidden questions about software details. That's not the job.

Post by tptacek » Tue, Jun 16, 2026, 7:41 PM UTC

tialaramex wrote: post #227

tptacek wrote: post #216

Earlier quoted context omitted.

If we're talking about actual auditors, not tech consultants who call themselves auditors but people actually trained as auditors, I'd take it as a bad sign if they asked a bunch of specific unbidden questions about software details. That's not the job.

The specific example I'm thinking of most strongly is when we were purchased one of the auditors looking over our software noticed that unlike most of the big company's other software at that time (about 2012) ours was HTTPS-only. Their checklist told them they need only to check there's HTTPS for authentication pages, and they asked if that's actually enough, is it fine if everything else is just plain HTTP as they'…