@@ -15,17 +15,21 @@ Types and Traits
15
15
:scope: module
16
16
:tags: numerics
17
17
18
- Code must not rely on Rust's implicit integer wrapping behavior that occurs in release builds.
19
- Instead, explicitly handle potential overflows using the standard library's checked,
18
+ Code must not rely on Rust's implicit integer wrapping behavior that may occur in release
19
+ builds. Instead, explicitly handle potential overflows using the standard library's checked,
20
20
saturating, or wrapping operations.
21
21
22
22
.. rationale ::
23
23
:id: rat_kYiIiW8R2qD1
24
24
:status: draft
25
25
26
26
In debug builds, Rust performs runtime checks for integer overflow and will panic if detected.
27
- However, in release builds (with optimizations enabled), integer operations silently wrap
28
- around on overflow, creating potential for silent failures and security vulnerabilities.
27
+ However, in release builds (with optimizations enabled), unless the flag overflow-checks is
28
+ turned on, integer operations silently wrap around on overflow, creating potential for silent
29
+ failures and security vulnerabilities. Note that overflow-checks only brings the default panic
30
+ behavior from debug into release builds, avoiding potential silent wrap arounds. Nonetheless,
31
+ abrupt program termination is usually not suitable and, therefore, turning this flag on must
32
+ not be used as a substitute of explicit handling.
29
33
30
34
Safety-critical software requires consistent and predictable behavior across all build
31
35
configurations. Explicit handling of potential overflow conditions improves code clarity,
0 commit comments