The release of the programming language Rust 1.98 has been published. Initially developed by Mozilla, it is now maintained by the independent non-profit organization Rust Foundation. The language focuses on safe memory management and provides tools for achieving high parallelism in task execution, all while avoiding the use of a garbage collector and runtime (with runtime limited to basic initialization and support for the standard library).
Memory handling methods in Rust aim to eliminate errors when manipulating pointers and protect against issues arising from low-level memory operations, such as accessing memory after it has been freed, dereferencing null pointers, buffer overflows, etc. To facilitate library distribution, ensure compilation, and manage project dependencies, the package manager Cargo is being developed. A repository, crates.io, is supported for hosting libraries.
Safe memory handling in Rust is ensured at compile time through reference checking, ownership tracking of objects, lifetime consideration (scope) of objects, and assessment of memory access correctness during code execution. Rust also provides means to protect against integer overflows, mandates the initialization of variable values before use, improved error handling in the standard library, employs the concept of immutability for references and variables by default, and offers strong static typing to minimize logical errors.
Key innovations:
- For the floating-point types f32 and f64, algebraic methods have been implemented for addition, subtraction, multiplication, division, and remainder, optimizing similarly to the '-ffast-math' option in C/C++ compilers. These methods allow for reordering of operations when necessary for optimizations like loop vectorization. For example, when calculating 'a + b + c + d', a typical compiler will compute it in one order '((a + b) + c) + d', while using the algebraic_add method can group the expression as '(a + b) + (c + d)', executing '(a + b)' and '(c + d)' in parallel using SIMD instructions. The trade-off for using algebraic methods is the non-determinism of the computed results, which may vary within a margin of error.
- For all primitive integer types, a built-in method 'format_into' has been implemented for converting numbers to strings, which can be used instead of the itoa package. It takes a parameter of type NumBuffer, which is guaranteed to be large enough to store any value of the used type in decimal format. The output is a formatted string &str, whose lifetime is tied to the buffer.
- Interaction between the ManuallyDrop wrapper and the Box smart pointer no longer leads to undefined behavior.
- A new batch of APIs has been promoted to stable, including stabilized methods and trait implementations:
- str::substr_range
- [T]::subslice_range
- core::fmt::NumBuffer
- ::format_into
- Send/Sync for std::process::CommandArgs
- {fN}::algebraic_add
- {fN}::algebraic_sub
- {fN}::algebraic_mul
- {fN}::algebraic_div
- {fN}::algebraic_rem
- NonZero::from_str_radix
- String::from_utf16le
- String::from_utf16le_lossy
- String::from_utf16be
- String::from_utf16be_lossy
- [T]::strip_circumfix
- str::strip_circumfix
- Atomic::from_mut
- Atomic::get_mut_slice
- Atomic::from_mut_slice
- std::range::legacy
- Target platforms thumbv7a-none-eabi, thumbv7a-none-eabihf, thumbv7r-none-eabi, thumbv7r-none-eabihf, and thumbv8r-none-eabihf have been moved to the second level of support, which means build guarantees but no guarantees during the testing suite.
- Support has been added for platforms powerpc64-unknown-linux-gnuelfv2 and aarch64-unknown-linux-pauthtest, which are provided with a third level of support. The third level includes basic support but without automated testing, publication of official builds, and verification of code build capabilities.
Additionally, it's worth noting the compromise of the popular crate package arrayref, which has over 53 million downloads in the last 90 days and is used as a dependency by 403 packages. Attackers uploaded new packages proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember containing malicious code to the crates.io repository. Subsequently, new releases of the arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 packages were published, adding the malicious package proc-macro1 as a dependency. The malicious version of the arrayref package was uploaded on August 20 at 10:15 (MSK) and lasted until 11:41, after which it was deleted by the crates.io administrators.
Attempts to contact the maintainer of arrayref for clarification of the situation have not yet been successful, but it is presumed that their credentials were intercepted by the attackers. The malicious modification in the proc-macro1 package was present in the build script and facilitated downloading an executable file from external sources. serverThe downloaded file was saved as /tmp/rust-setup in Unix systems, while in Windows it was %TEMP%\rust-setup.ps1 or %TEMP%\rust-setup-launch.vbs.
Source: opennet.ru
