How would using a language different than C help here? At it's core this bug is a logic bug, where "*" == crypt(x), because crypt in musl started returning "*" in some cases some years ago. This could be Rust. This could be Go.

Not every C vuln is a memory safety problem.

▲

rhdjebejdbd 2 hours ago | parent | next [-]

Another comment said that returning a * was to avoid returning null which would crash users of the library who didn't check for null. That seems like a C smell to me

▲

ethin an hour ago | parent [-]

Not really. This is like if the char* were an Option<String> but you had programs which stupidly didn't check if the Option had something and assumed it always did. As others have said, Rust would not prevent this.

	▲	K0nserv 31 minutes ago \| parent [-]
		`Option<String>` or `Result<String>` forces the check at the callsite. Unlike C, you cannot forget that the function can error. This absolutely helps prevent issues like this. Now, the decision to return `"*"` instead of letting poorly written code crash on `NULL` is not good either.

▲

bmacho an hour ago | parent | prev | next [-]

> How would using a language different than C help here?

Easier to formulate invariants and check/prove them. Better language correlates with safer software.

▲

realharo 2 hours ago | parent | prev | next [-]

>because crypt in musl started returning "*" in some cases some years ago

In Rust, the type of the return value would be a `Result<T, E>`, which means the chain of events that led to this would never have started in the first place.

▲

my-huge-pony 2 hours ago | parent [-]

In C the return value would be NULL, except it was changed by musl at some point.

Edit: at the beginning, crypt always returned a value. So hypothetical Rust return type would be a String, and then it would be retained for backward compatibility. Or something else would happen, this is a complex logic bug triggered by a 25 year old chain of events.

	▲	realharo 2 hours ago \| parent [-]
		The type of the value in C is `char`. That's what led some people to write code where it crashes without checks. Which is still their mistake. But if the type was something that can't be implicitly used like an always-present value, that would* have prevented the situation, even with those same people.

▲

slopinthebag 2 hours ago | parent | prev [-]

why does this logic bug exist? why are they returning a string, why not a result type, (nil, err), or something else?

oh right, because c is a crusty old language with barely any features.