News for hackers. Stuff that matters.
Re:size_t-to-int vulnerability in Linux’s filesystem layer by mnw21cam on Tuesday July 20, 2021 @11:28AM (#27894939)
Add Java to that list.
Re:size_t-to-int vulnerability in Linux’s filesystem layer by csharptwdec19 on Tuesday July 20, 2021 @12:29PM (#27895884)
Same for C#. Any narrowing truncation needs to be an explicit cast. Widening is typically allowed implicitly, although in the case of the 'decimal' (128 bit struct representing a 'higher precision' floating point) type you still need an explicit cast from a 'double', since there are cases where that conversion can still change the value or fail (i.e. Infinity/NaN)
Re:size_t-to-int vulnerability in Linux’s filesystem layer by pjmlp on Tuesday July 20, 2021 @01:06PM (#27896357)
Microsoft is considering turning on by default checked arithmetic in the 2022 Visual Studio templates, by the way.
Re:size_t-to-int vulnerability in Linux’s filesystem layer by irogers on Tuesday July 20, 2021 @05:02PM (#27899292)
It can catch people by surprise that Java's narrowing conversions may not preserve the sign. For example, the following is broken:

class TimestampedObject implements Comparable<TimestampedObject> { long timestamp; int compareTo(TimestampedObject other) { return (int)(timestamp - other.timestamp); } ... }

ErrorProne catches this: https://errorprone.info/bugpattern/BadComparable

Re:size_t-to-int vulnerability in Linux’s filesystem layer by paulddraper on Tuesday July 20, 2021 @03:15PM (#27897937)
Noo! This idea is super new and was invented by Go/Rust.