The Rust 1.98 programming language, founded by the Mozilla project but now developed under the auspices of the independent non-profit Rust Foundation, has been released. The language focuses on memory safety and provides tools for achieving high parallelism of task execution, while doing without the use of a garbage collector and runtime (the runtime is reduced to basic initialization and maintenance of the standard library).
Rust's memory management methods are designed to eliminate errors in pointer manipulation and protect against issues arising from low-level memory management, such as accessing memory after it has been freed, dereferencing null pointers, buffer overruns, and so on. The project is developing the Cargo package manager to distribute libraries, facilitate builds, and manage dependencies. The crates.io repository is maintained for hosting libraries.
Memory safety is provided in Rust at compile time through reference checking, keeping track of object ownership, keeping track of object lifetimes (scopes), and assessing the correctness of memory access during code execution. Rust also provides protection against integer overflows, requires mandatory initialization of variable values before use, handles errors better in the standard library, applies the concept of immutable references and variables by default, offers strong static typing to minimize logical errors.
Main innovations:
- For the f32 and f64 floating-point types, algebraic methods for addition, subtraction, multiplication, division, and remainder are implemented, implementing optimizations similar to the "-ffast-math" option in C/C++ compilers. These methods allow changing the order of operations when necessary for optimizations such as loop vectorization. For example, when calculating "a + b + c + d" using regular addition, the compiler will always perform the calculation in the same order: "((a + b) + c) + d", but using the algebraic_add method, it can group the expression as "(a + b) + (c + d)" and execute "(a + b)" and "(c + d)" in parallel using SIMD instructions. The price of using algebraic methods is nondeterminism of the calculation results, which can vary within the error margin.
- All primitive integer types have a built-in "format_into" method for converting numbers to strings, which can be used instead of the itoa package. A NumBuffer buffer is passed as a parameter. , whose size is guaranteed to be sufficient to write any value of the used type in decimal form. The output is a formatted string &str, whose lifetime is bound to the buffer.
- Interaction between the ManuallyDrop harness and the Box smart pointer no longer results in undefined behavior.
- A new portion of the API has been moved to the category of stable, including the methods and implementations of traits have been stabilized:
- str::substr_range
- [T]::subslice_range
- core::fmt::NumBuffer
- <{integer}>::format_into
- Send/Sync for std::process::CommandArgs
- {fN}::algebraic_add
- {fN}::algebraic_sub
- {fN}::algebraic_mul
- {fN}::algebraic_div
- {fN}::algebraic_rem
- NonZero<{integer}>::from_str_radix
- String::from_utf16le
- String::from_utf16le_lossy
- String::from_utf16be
- String::from_utf16be_lossy
- [T]::strip_circumfix
- str::strip_circumfix
- Atomic ::from_mut
- Atomic ::get_mut_slice
- Atomic ::from_mut_slice
- std::range::legacy
- The target platforms thumbv7a-none-eabi, thumbv7a-none-eabihf, thumbv7r-none-eabi, thumbv7r-none-eabihf, and thumbv8r-none-eabihf have been moved to the second level of support, which includes a build guarantee but no guarantees for passing the test suite.
- Support has been added for the powerpc64-unknown-linux-gnuelfv2 and aarch64-unknown-linux-pauthtest platforms, which are now at level 3 support. Level 3 includes basic support, but does not include automated testing, official build releases, or build verification.
Additionally, the popular crate package arrayref, which has been downloaded over 53 million times in the last 90 days and is used as a dependency by 403 packages, was compromised. Attackers posted new packages containing malicious code to the crates.io repository: proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember. Subsequently, new releases of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 were published to the repository, each adding the malicious proc-macro1 package as a dependency. The malicious version of the arrayref package was posted on August 20 at 10:15 AM (MSK) and remained active until 11:41 AM, after which it was removed by crates.io administrators.
The maintainer of arrayref has not yet been contacted to clarify the situation, but it is believed that their credentials were intercepted by attackers. In the proc-macro1 package, a malicious change was present in the build script and loaded an executable file from an external directory. Server. The downloaded file was saved as /tmp/rust-setup on Unix systems, and in Windows — %TEMP%\rust-setup.ps1 or %TEMP%\rust-setup-launch.vbs.
Source: opennet.ru
