Project for porting C to Rust gains Mozilla's backing (InfoWorld)

The developer can opt-into checked addition (actually most integer operations can be check) which returns an Option<usize> (usize is being used here as an example, usize in Rust is the same as C's size_t). The Option<usize> is just a tagged union of char, size_t where the char signals if overflow occurred.

Here [1] is a simple playpen link where you can see the various ASM generated the different levels (debug/release).

[1] https://play.rust-lang.org/?gist=2bd93049475dda6e75e345a9...

In debug mode, by default, signed and unsigned integer overflows panic (i.e. unwind the current thread's stack then terminate the thread). (Incidentally, unwinding the stack across FFI boundaries is apparently undefined behaviour, so if you ever call from C into Rust then the Rust code must either spawn a new thread to do all its work or else must be absolutely convinced it's not going to panic (which seems hard to guarantee if it's doing any arithmetic).)

In release mode, by default, overflows wrap as two's complement.

There could be compiler options to turn the checking on/off in different parts of the program.

It seems to be designed as a debugging feature, not a security feature. It's discussed as being equivalent to debug assertions, which are helpful during development but typically disabled in production for performance, so programs shouldn't rely on them to prevent exploits.

Integer types have some low-level explicit arithmetic methods: "wrapping_add" (always wraps), "saturating_add", "checked_add" (returns Some(n) or None on overflow). And for people who prefer operator overloading there's the "Wrapping" type, e.g. if "let x = Wrapping(0u32) - Wrapping(1u32)" then "x.0 == std::u32::MAX".

As far as I can tell from Corrode's source (admittedly I'm not very familiar with Literate Haskell), it uses the wrapping_add etc methods for unsigned arithmetic, and standard arithmetic operators for signed.