A serious security bug... caused by no bounds checking.

[David Nadlinger]

On Tuesday, 8 April 2014 at 21:23:35 UTC, Andrei Alexandrescu 
wrote:
> On 4/8/14, 1:07 PM, Martin Krejcirik wrote:
>> On Tuesday, 8 April 2014 at 19:47:02 UTC, Andrei Alexandrescu 
>> wrote:
>>> For the record, dmd used to remove bounds checking in 
>>> -release mode.
>>> I've asked Walter to add a new flag for that, independent
>>
>> It still does (for un- at safe functions) and there is no way to 
>> turn it on
>> (if you don't want asserts and contracts).
>
> :o|
>
> We need to fix that.

Just for the record, LDC has -enable-boundscheck and 
-disable-boundscheck (in line with all the other flags for 
enabling-disabling certain features). If neither is specified, 
the DMD default (-release disables checks in non- at safe code) is 
used.

David