Re:Google assigns a CVE for libwebp and gives it a 10.0 score
by pclmulqdq on Tuesday September 26, 2023 @03:34PM
(#37664722)
C and C++ are often used because at the optimization level that these sorts of libraries use, Rust makes tradeoffs that do not work out to 0 overhead. I would personally suggest that Google et al invest in figuring out how to make "formally-verified C" a more widely adopted language for libraries that are truly security-critical.
Re:Google assigns a CVE for libwebp and gives it a 10.0 score
by namibj on Wednesday September 27, 2023 @02:27AM
(#37670918)
C safe enough to use for parsing untrusted input like this needs to be either formally verified to be safe (not to be correct, at least it's it's the canonical implementation), or written in an intrinsically memory-safe way which humans can fully reason about the safety of.
And at that latter point it's slower than Rust. (Not too mention that Rust's awareness of memory lifetimes enables substantial optimizations beyond plain C code that quite often result in faster code at the same level of effort.)
Re:Google assigns a CVE for libwebp and gives it a 10.0 score
by pjmlp on Wednesday September 27, 2023 @03:45AM
(#37671425)
People should learn to use profilers, not even C and C++ do zero overhead versus writing in pure Assembly.
Maybe WEBP should have been written in Assembly, all the speed and I bet quite safe. /s
WebP gets a slight pass because the code is so old; WebP is at least partly based on code from On2 that extends back at least until the early '00s. Rewriting working code is always going to be lower priority than writing new code (and it's not always a safety win either; being deployed for 10 years gets you an awful lot of real-world testing!).
But look at implementations for newer image formats and you see more of the same; C and C++ with the token java implementation that won't get used outside of the JVM.