Curl/libcurl HIGH CVE-2023-38545 leaked early?

Post by hyperman1 » Wed, Oct 11, 2023, 12:43 PM UTC

andersa wrote: post #24

hyperman1 wrote: post #20

Earlier quoted context omitted.

While I agree with the general thrust of your comment, note that a) this is specifically adressed in Daniel's blog post b) He stated the reason why it's not happening right now multiple times already, and they seem well thought out. (Basically, the code base is huge and not easily converted, and there is no compiler support for some of the platforms libcurl supports). Engineering is based on trade offs. In this speci…

Yeah, it was more of a general "old man yells at cloud" comment not aimed at anything in particular. It's just frustrating that we shouldn't have 99% of these vulnerabilities. Don't even have to go all the way with the borrow checking and rust, just basic bounds checks on all containers through templates would be a massive improvement over using C. Yes, the performance will degrade by some single digit %, but nobody…