search

rust-secure-code / safety-dance

Auditing crates for unsafe code which can be safely replaced
Apache License 2.0
528 stars 10 forks source link

Audit prost #68

Open Shnatsel opened 4 years ago

Shnatsel commented 4 years ago

prost is a protobuf implementation with 3000 daily downloads. It is a high-risk component because it is exposed to untrusted data from the network.

Protocol buffers involve code generation, so simply auditing the runtime code is not sufficient - we should also look into reducing the amount of unsafe in the generated code.

Shnatsel commented 4 years ago

The core library has only 6 unsafe blocks, but I haven't looked at the code that it generates.

alex commented 4 years ago

Quick PR removing one of them https://github.com/danburkert/prost/pull/288

dbrgn commented 2 years ago

Quick PR removing one of them https://github.com/danburkert/prost/pull/288

Issue tracker moved to https://github.com/tokio-rs/prost/pull/288.

The PR was closed because apparently the performance regressed. If the generated assembly is identical, how can this decrease performance?