438 karma · joined August 29, 2019
A generic block_on in std would be a footgun for new programmers I believe.
Interesting although this seems a little out of date because xml seems to one of the least desirable data formats for modern programming languages. Maybe this is more useful for legacy enterprise use cases that I don’t know about.
You can line for line rewrite the code with unsafe rust and get the same exploit with a bad memcpy[1]. But this code would never have used unsafe rust.
The method that was exploited was "append user supplied strings to the end of a string". This can easily be written in safe rust, a thousand different ways. Here is one way it could have been written.
write!(&mut heapblockstring, ",{}={}\0", key, string).unwrap();
If this was the code in the kernel, you would have gotten an intentional crash and not privilege escalation
[1] https://doc.rust-lang.org/std/intrinsics/fn.copy_nonoverlapp...
On the bright side Flash is just being used as a player for static mp3's referenced in the HTML, so you can just open the files by yourself.
I might tune in to this "Cloudflare TV". Also when i was watching the best of video on bots there was a error saying "Quota exceeded". Not sure why that popped up.