Hacker News new | past | comments | ask | show | jobs | submit login

Can we not take malicious advantage of panicking the same way we do with use-after-free?



Panicking can be leveraged for a DoS attack. Use after free can be leveraged for arbitrary code execution.


How about exceptions?


Panics are implemented in the same way as exceptions are in C++, beyond that Rust doesn't have a concept of exceptions at all. Fallibility is expressed in terms of sum types that signal state for success or failure with Result.


> Panics are implemented in the same way as exceptions are in C++

If this is true or at least fundamentally very close to each other, and given that exceptions can be abused for arbitrary code execution [1] [2], then it follows that Rust is no different/safer with respect to that, no?

[1] https://billdemirkapi.me/exception-oriented-programming-abus... [2] https://billdemirkapi.me/abusing-exceptions-for-code-executi...


No, you can't.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: