Re:Safe C++ proposal is not being continued
by m3047 on Sunday September 14, 2025 @01:48PM
(#45241753)
Rust has unsafe, just like Java.
Re:Safe C++ proposal is not being continued
by maleldil on Sunday September 14, 2025 @04:27PM
(#45242957)
On the other hand, _all_ of C++ is unsafe.
Re:Safe C++ proposal is not being continued
by arkush on Sunday September 21, 2025 @01:03PM
(#45324554)
> > Normally no one talks anymore about things like buffer overflows, use after free,... since years
> Some of the biggest vulnerabilities of recent years (e.g. Heartbleed) were out-of-bounds access.
If I understand the Heartbleed bug correctly, it did not involved buffer overflows. It was a logical bug where they "trusted" the user-provided payload length (that can be much larger than the actual payload) and allocated the response buffer accordingly without zeroing it (malloc vs calloc). The "trash" in the uninitialized memory turned out to be quite valuable.
"xkcd: Heartbleed Explanation":
"Add heartbeat extension bounds check.":
https://github.com/openssl/openssl/commit/731f431497f463f3a2...
Some of the biggest vulnerabilities of recent years (e.g. Heartbleed) were out-of-bounds access. The most common vulnerability sources are things that are impossible in Rust, but cannot be fully solved via C++ static checkers.