Re:The Piston image library is now pure Rust
by dbaupp on Sunday January 08, 2017 @01:58PM
(#13351279)
(FWIW, I don't think any of those bugs are directly addressed by Rust's memory safety guarantee, since they mostly seem to be string injection problems. The strong abstraction power of Rust versus C may help people create APIs that are more resistant, but people can always write bad code. And of course, those are unlikely to be the only bugs in that C code.)
Re:The Piston image library is now pure Rust
by tinus_hn on Sunday January 08, 2017 @05:49PM
(#13352550)
Unfortunately, these bugs will not be prevented by using rust as they are not memory related bugs.
If you code a command that reads and then deletes a file on the command line and people allow remote users to invoke that command remotely, the programming language is not going to help you.
ImageMagick doesn't have the design that is necessary to be exposed to remote users. So it shouldn't be.
"One of the vulnerabilities can lead to remote code execution (RCE) if you process user submitted images."