@@ -16,17 +16,26 @@ Types and Traits
16
16
:scope: module
17
17
:tags: numerics
18
18
19
- Code must not rely on Rust's implicit integer wrapping behavior that occurs in release builds.
20
- Instead, explicitly handle potential overflows using the standard library's checked,
19
+ Code must not rely on Rust's implicit integer wrapping behavior that may occur in release
20
+ builds. Instead, explicitly handle potential overflows using the standard library's checked,
21
21
saturating, or wrapping operations.
22
22
23
23
.. rationale ::
24
24
:id: rat_kYiIiW8R2qD1
25
25
:status: draft
26
26
27
27
In debug builds, Rust performs runtime checks for integer overflow and will panic if detected.
28
- However, in release builds (with optimizations enabled), integer operations silently wrap
29
- around on overflow, creating potential for silent failures and security vulnerabilities.
28
+ However, in release builds (with optimizations enabled), unless the flag `overflow-checks `_ is
29
+ turned on, integer operations silently wrap around on overflow, creating potential for silent
30
+ failures and security vulnerabilities. Note that overflow-checks only brings the default panic
31
+ behavior from debug into release builds, avoiding potential silent wrap arounds. Nonetheless,
32
+ abrupt program termination is usually not suitable and, therefore, turning this flag on must
33
+ not be used as a substitute of explicit handling. Furthermore, the behavior in release mode is
34
+ under consideration by the The Rust Language Design Team and in the future overflow checking
35
+ may be turned on by default in release builds (it is a `frequently requested change `_).
36
+
37
+ .. _overflow-checks : https://github.com/rust-lang/rust/blob/master/src/doc/rustc/src/codegen-options/index.md#overflow-checks
38
+ .. _frequently requested change : https://lang-team.rust-lang.org/frequently-requested-changes.html#numeric-overflow-checking-should-be-on-by-default-even-in-release-mode
30
39
31
40
Safety-critical software requires consistent and predictable behavior across all build
32
41
configurations. Explicit handling of potential overflow conditions improves code clarity,
0 commit comments