Reblogged by isagalaev ("Ivan Sagalaev :flag_wbw:"):
my main takeaway from the new libcurl cve is "async/await and yield syntax is great"
like sure pervasive/mandatory bounds checks would have avoided the worst part but the root issue was "hand-writing state-machines is hard as hell"
the equivalent behaviour in a language with builtin async/await would have been a local boolean suddenly changing from true to false without it being modified -- a really evil and hard to debug compiler bug