The Shift Around [Bug] Multiple Memory Safety

Urus markets itself as safer than C, but four memory flaws in urus_runtime.h expose real risks. Critical bugs include uninitialized lengths in str_replace, missing cleanup in pop(), unchecked malloc returns in read_file, and silent failures in ftell(). These flaws cause garbage data, crashes, and silent leaks - especially dangerous in long-running systems. POCs show 268MB of heap leak after 1000 pops and segfaults on low-memory runs. Fixes include safe allocation wrappers, proper NULL checks, and validating ftell() and fread. Understanding these vulnerabilities isn’t just technical - it’s essential for building trust in systems that claim safety. How well do you guard against invisible memory flaws in modern code?nnnn### What’s at Stake?nUrus’ promise of ‘reference counting’ and ‘immutable by default’ crumbles under scrutiny. When r->len remains uninitialized, string functions return garbage; when malloc fails and NULL isn’t checked, programs crash. Silent leaks grow fast: 176KB after 5,000 allocations. These aren’t just bugs - they’re breaches of user confidence.nnnn### The Hidden Dangersn- Uninitialized len: str_replace() reads garbage instead of valid data.n- NULL deallocation: pop() frees elements without cleaning referenced objects, corrupting memory.n- Silent malloc failures: read_file() ignores ftell() errors and fread issues, producing corrupted strings.n- Unchecked ftell(): Returns -1 (especially on pipes or FIFOs), triggering crashes when used with malloc.nnnn### Why This Matters for Developers and UsersnEven ‘safer than C’ code must defend against memory misuse. A single leak or crash can destabilize critical systems - from embedded devices to cloud services. Awareness turns vulnerability into prevention. Can your Rust or C runtime handle these hidden risks?nnnn### Final ThoughtnMemory safety isn’t a feature - it’s a foundation. The Urus runtime’s flaws prove even well-intentioned designs fail without rigorous checks. As we build smarter systems, let’s build them with defenses that outlast hype.”