News for hackers. Stuff that matters.
Re:This shouldn't have happened: A vulnerability postmortem by snovv_crash on Friday December 03, 2021 @06:16AM (#29428762)
Assuming you ever encounter the issue, sure. But this bug was only triggered by long keys, which are outside of the normal operating paradigms. So your Rust code calling into a C API would have had exactly the same security vulnerability as C++.

On the other hand, something like Java via JNI wouldn't, because it copies the data to a different address space as it goes through the language boundary. Horribly inefficient, but at least the C code only causes security issues in the C regions. By the time it gets back into Java it either crashes or it's safe again, no undefined behaviour leaks through the API boundary.

Re:This shouldn't have happened: A vulnerability postmortem by staticassertion on Friday December 03, 2021 @12:25PM (#29432540)
Copying the data before the FFI boundary would have done absolutely nothing to prevent this bug or make it any less difficult to exploit tho