News for hackers. Stuff that matters.
Re:Ask HN: Does Compiling to WebAssembly Prevent Issues with... by averageValentin on Friday November 03, 2023 @10:23AM (#38129194)
Compiling to WebAssembly can mitigate certain issues, specificaly with memory safety in unsafe languages like C.

Take this C function: void write_to_buffer(char *buffer, unsigned int size, char value) { for (unsigned int i = 0; i <= size; ++i) { buffer[i] = value; // Unsafe: can write past the buffer if size is too large } }

Compiled to native code, an incorect size can lead to a buffer overflow. However, if you compile this to WebAssembly, the out-of-bounds write would be caught by the WebAssembly runtime, preventing a potential security flaw. But it doesn't eliminate the need for good coding practices, it does add a layer of protection against some kinds of memory-related errors

Re:Ask HN: Does Compiling to WebAssembly Prevent Issues with... by fwsgonzo on Friday November 03, 2023 @10:41AM (#38129523)
Are you sure the run-time will bounds-check buffers like that? I thought WASM sandboxes were just one big bump-allocator arena.
Re:Ask HN: Does Compiling to WebAssembly Prevent Issues with... by averageValentin on Friday November 03, 2023 @07:04PM (#38136222)
Appreciate the clarification. You're right that WebAssembly doesn't enforce bounds checking within its linear memory, allowing for out-of-bounds writes within the allocated space. While it does enhance security at the host boundary, it doesn't absolve the need for careful memory management within the WebAssembly module itself