You are using an out of date browser. It may not display this or other websites correctly. You should upgrade or use an alternative browser.
panic handling
About this tag
Panic handling in Rust-based systems like OSTree can introduce denial-of-service vulnerabilities when unsafe routines attempt to report a prior panic, leading to double-unwind or abort scenarios. A specific example is CVE-2022-47085, where a panic-printing helper in OSTree's Rust bindings could itself panic, allowing an attacker to crash OSTree-driven components. The fix replaced eprintln!-based reporting with a conservative direct stderr write. This tag covers discussions of safe panic handling practices, particularly in Rust bindings and system-level software, to prevent such vulnerabilities.
A panic-printing helper in OSTree’s Rust bindings quietly opened a path to denial-of-service: a small, unsafe panic-handling routine in rust-bindings/src/repo_checkout_at_options/repo_checkout_filter.rs could itself panic while trying to report a prior panic, producing a double-unwind or abort...