Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git security vulnerabilities announced

github.blog

Post reply on HN
Print view View original

21–30 of 139 posts

Re: Git security vulnerabilities announced

#21

Post by re »

hypeatei wrote: post #14
sshine wrote: post #6

Earlier quoted context omitted.

Rust does have a fix for this: error: this arithmetic operation will overflow --> src/main.rs:2:18 | 2 | let a: u64 = u64::MAX + 1; | ^^^^^^^^^^^^ attempt to compute `u64::MAX + 1_u64`, which would overflow | = note: `#[deny(arithmetic_overflow)]` on by default Rust also allows for overflowing arithmetic (preserving the default to fail): https://doc.rust-lang.org/std/?search=overflowing It's generally less ergonomic,…

Slightly related, I wonder why the return type for `overflowing_add` isn't `Result ` and instead a tuple containing a boolean?

There are times when you want to know how much overflow occurred -- think of the way you learn to do multi-digit addition. There is a checked_add that returns an Option if you only care about success/failure.

Re: Git security vulnerabilities announced

#22

Post by jcparkyn »

hypeatei wrote: post #14
sshine wrote: post #6

Earlier quoted context omitted.

Rust does have a fix for this: error: this arithmetic operation will overflow --> src/main.rs:2:18 | 2 | let a: u64 = u64::MAX + 1; | ^^^^^^^^^^^^ attempt to compute `u64::MAX + 1_u64`, which would overflow | = note: `#[deny(arithmetic_overflow)]` on by default Rust also allows for overflowing arithmetic (preserving the default to fail): https://doc.rust-lang.org/std/?search=overflowing It's generally less ergonomic,…

Slightly related, I wonder why the return type for `overflowing_add` isn't `Result ` and instead a tuple containing a boolean?

Probably because you'd want to access the value in either case, depending on your application.

Re: Git security vulnerabilities announced

#23

Post by dcsommer »

bbojan wrote: post #3

Both critical bugs are integer overflows. It's unclear to me why our languages still default to modulo arithmetic semantics. I feel Rust had a chance to fix this, but also dropped the ball.

Integer overflow isn't a security issue unless your program's memory safety depends on the correctness of the integer operation. Safe rust doesn't (in any build mode), but C/C++ does.

Re: Git security vulnerabilities announced

#24

Post by Pr0ject217 »

b112 wrote: post #9
sshine wrote: post #7

[Edit: According to @rlpb's comment, git 2.39.1 is already available on Ubuntu] To install the latest git on Ubuntu: sudo apt upgrade git [Former post included instructions on how to install git from https://launchpad.net/~git-core/+archive/ubuntu/ppa ]

Ubuntu will update git, without having to add this.

Hopefully soon :)

Re: Git security vulnerabilities announced

#25

Post by kibwen »

shepmaster wrote: post #5
bbojan wrote: post #3

Both critical bugs are integer overflows. It's unclear to me why our languages still default to modulo arithmetic semantics. I feel Rust had a chance to fix this, but also dropped the ball.

> Rust had a chance to fix this, but also dropped the ball. By default , a Rust project will panic on integer overflow in debug builds and will overflow on release builds. Two key points to note, however: 1. You can change the setting so that your project panics in release or overflows in debug mode. 2. We reserved the right to change the default at some point in the future. This will probably be widely communicated…

Furthermore, because integer overflow is defined behavior, the integer overflow is never considered a root cause in Rust. In order for an integer overflow to express as UB in Rust, you'd have to use it in conjunction with an `unsafe` block that was failing to ensure its invariants, and that would be considered the root cause. If you're not using `unsafe`, then an integer overflow is at worst a logic bug.

Re: Git security vulnerabilities announced

#26

Post by shiftingleft »

dcsommer wrote: post #23
bbojan wrote: post #3

Both critical bugs are integer overflows. It's unclear to me why our languages still default to modulo arithmetic semantics. I feel Rust had a chance to fix this, but also dropped the ball.

Integer overflow isn't a security issue unless your program's memory safety depends on the correctness of the integer operation. Safe rust doesn't (in any build mode), but C/C++ does.

To elaborate on this: Rust always performs bounds checks on array accesses, so you can't get an out-of-bound read/write.

Re: Git security vulnerabilities announced

#27

Post by sshine »

hypeatei wrote: post #14
sshine wrote: post #6

Earlier quoted context omitted.

Rust does have a fix for this: error: this arithmetic operation will overflow --> src/main.rs:2:18 | 2 | let a: u64 = u64::MAX + 1; | ^^^^^^^^^^^^ attempt to compute `u64::MAX + 1_u64`, which would overflow | = note: `#[deny(arithmetic_overflow)]` on by default Rust also allows for overflowing arithmetic (preserving the default to fail): https://doc.rust-lang.org/std/?search=overflowing It's generally less ergonomic,…

Slightly related, I wonder why the return type for `overflowing_add` isn't `Result ` and instead a tuple containing a boolean?

My guess is:

The `(T, bool)` that gets returned is friendly towards optimization.

If you don't use the bool, the overflowing arithmetic is reduced to efficient arithmetic which is overflowing by default. If you do use the bool, the generated code contains one extra instruction.

Re: Git security vulnerabilities announced

#28

Post by rlpb »

b112 wrote: post #9
sshine wrote: post #7

[Edit: According to @rlpb's comment, git 2.39.1 is already available on Ubuntu] To install the latest git on Ubuntu: sudo apt upgrade git [Former post included instructions on how to install git from https://launchpad.net/~git-core/+archive/ubuntu/ppa ]

Ubuntu will update git, without having to add this.

Indeed! Ubuntu updated git at 18:44Z, nearly an hour before you posted that comment :-)

Re: Git security vulnerabilities announced

#29

Post by hyperhopper »

xxpor wrote: post #4
bbojan wrote: post #3

Both critical bugs are integer overflows. It's unclear to me why our languages still default to modulo arithmetic semantics. I feel Rust had a chance to fix this, but also dropped the ball.

>It's unclear to me why our languages still default to modulo arithmetic semantics. Because that's what processors do? (leaving aside backwards compatibility issues)

Our processors also require manually manipulating registers.

The whole point of higher level programming languages is to abstract away the fiddly bits of dealing with processors that we don't want to have to deal with.

This is one of those cases.

Re: Git security vulnerabilities announced

#30

Post by hyperhopper »

dcsommer wrote: post #23
bbojan wrote: post #3

Both critical bugs are integer overflows. It's unclear to me why our languages still default to modulo arithmetic semantics. I feel Rust had a chance to fix this, but also dropped the ball.

Integer overflow isn't a security issue unless your program's memory safety depends on the correctness of the integer operation. Safe rust doesn't (in any build mode), but C/C++ does.

You don't know the business logic of every program. You can't say that a rust program won't have a security issue due to this.

`UserAccessLevel > Threshold`

Like there could be a million ways an integer becoming small could mess up something.

Also there are business logic issues as well

Post reply on HN