News for hackers. Stuff that matters.
Re:Heap-based buffer overflow in Sudo by myrrlyn on Tuesday January 26, 2021 @06:37PM (#25922359)
helps that a 10kloc c program getting riir'd probably won't be a 10kloc rust program, because c doesn't have libraries and rust does.

it is literally impossible to write "a small codebase focused on its key value-adds without distractions" in a language that doesn't have strings and requires you to build a dictionary from scratch

Re:Heap-based buffer overflow in Sudo by ddevault on Tuesday January 26, 2021 @06:51PM (#25922461)
>helps that a 10kloc c program getting riir'd probably won't be a 10kloc rust program, because c doesn't have libraries and rust does.

What? Rust has so few libraries of significance that it still depends on C for security-critical areas like SSL.

>it is literally impossible to write "a small codebase focused on its key value-adds without distractions" in a language that doesn't have strings and requires you to build a dictionary from scratch

Strings are misunderstood, I'm not going to get into it here. My dictionaries in C usually clock in at about two dozen lines of code. The complexity doesn't go away because your language does it for you.

Re:Heap-based buffer overflow in Sudo by saagarjha on Tuesday January 26, 2021 @07:10PM (#25922593)
Having written dictionary implementations in C, I would be very interested in seeing your implementation that fits in two dozen lines of code.
Re:Heap-based buffer overflow in Sudo by ddevault on Tuesday January 26, 2021 @07:25PM (#25922709)
Threw together an example (untested, with obvious errors) to give you an idea of what it could look like:

https://paste.sr.ht/~sircmpwn/3122d4a27a8e5312462e2329bf7ed6...

Actually managed to get it to exactly 2 dozen lines of code, not including the header, which isn't bad for an off-the-cuff remark.

You'd naturally expand or shrink this with whatever subset of map functions you require, like key/value enumeration, object deletion, resizing, whatever. It depends on your use-case. I don't believe in generic code.

Re:Heap-based buffer overflow in Sudo by saagarjha on Tuesday January 26, 2021 @07:46PM (#25922870)
Ok, that makes more sense. I was considering a slightly more fully-featured table and including the header (see: https://gist.github.com/saagarjha/00faa1963023206a8ccd987798...) and I was a couple times larger than your number, so I was trying to figure out what you were doing that I was unable to replicate…
Re:Heap-based buffer overflow in Sudo by vitno on Tuesday January 26, 2021 @07:00PM (#25922533)
that's not true these days, rustls is a great TLS lib that has been through at least one serious external security audit.

https://cure53.de/pentest-report_rustls.pdf

Re:Heap-based buffer overflow in Sudo by roblabla on Tuesday January 26, 2021 @07:37PM (#25922805)
For what it's worth, rustls relies on ring which has primitives written in C and ASM because getting constant-time operation guarantees from Rust is Very Hard. Though progress is being made on this area.