News for hackers. Stuff that matters.

A comment on Google assigns a CVE for libwebp and gives it a 10.0 score. Parent comment

Re:Google assigns a CVE for libwebp and gives it a 10.0 score by chlorion on Tuesday September 26, 2023 @07:08PM (#37667104)
Just having first class slice types, where your pointer is paired with a length, which allows for doing bounds checking automatically is a huge upgrade over C, even if it doesn't solve every other problem.

Security exploits from out of bounds access should not be happening today, bounds checking is a solved problem, and has been solved for decades.

[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by pjmlp on Wednesday September 27, 2023 @03:43AM (#37671413)
Time to make the point that not even C authors were able to change WG14 mind on the necessity of having fat pointers.

https://www.bell-labs.com/usr/dmr/www/vararray.pdf

[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by winter_blue on Wednesday September 27, 2023 @10:57AM (#37675570)
That's a pretty interesting paper. Thanks for sharing it. I wonder why Dennis Ritchie, with the weight his name carries, wasn't able to push it into mainstream implementation...
[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by pjmlp on Wednesday September 27, 2023 @12:02PM (#37676703)
Because once a language is managed by ISO, that doesn't matter, the author gets one vote like everyone else.

So this shows how the majority of WG14 members see security in C.

[ Parent | on HN ]