PHphillmv·Mar 4, 2022
the actual commit fix has some comments that may be useful for understanding:
https://github.com/github/cmark-gfm/commit/ac80f7b56522ffa15...
In Heap memory corruption in GitHub's Markdown table parsing extensiongithub
cmark-gfm
C2018–2022
github / cmark-gfm
cmark-gfm
GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C
8Distinct people
8Mentions
0Explicit recommenders
1.1KGitHub stars
What to know before exploring
What it is
GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 11:56:56 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year8 dated mentions
Observed mentions: 2018-10-17 12:11:40 UTC to 2022-03-04 17:36:03 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 3 | 1 | 2 |
What Hacker News says
8 sourcesThis seems to be the patch: https://github.com/github/cmark-gfm/commit/cf7577d2f74289cb8...
Integer overflow can happen in Rust, but it's well-defined, not undefined. This helps.
Bounds checking is part of indexing, and so even if an index overflows, the check should happen, and panic.
"impossible" is a strong word, but it would be significantly less likely in Rust. If you did the same thing as you did in C, with unsafe, then it could happen. But there's not a lot of reason to 99.9999% of the time, as it's the more difficult and less ergonomic option.
In Heap memory corruption in GitHub's Markdown table parsing extensionHeap memory corruption in GitHub's Markdown table parsing extension
83 points · Open discussionActually it was implemented in Nov 2017, but only deployed/enabled for GitHub Pages.
https://github.com/github/cmark-gfm/pull/64
See this comment: https://github.com/github/cmark-gfm/pull/64#issuecomment-401...
In Footnotes now supported in GitHub MarkdownYes, simply look at the latest release which contains three bugfixes related to footnotes:
https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm....
In Footnotes now supported in GitHub MarkdownIs this implemented in cmark-gfm?
https://github.com/github/cmark-gfm
In Footnotes now supported in GitHub MarkdownThanks. That part isn't yet written. (It's early days still.)
In a nutshell though: JSON (for example) doesn't mean anything. It has no semantics - it's just syntax. I wanted something that had a semantics. Plus, proper support for binary, records, and sets, and keys in dictionaries that didn't have to be strings.
There's a wee proto-essay on "why not just use JSON" in an appendix: https://gitlab.com/tonyg/preserves/blob/master/preserves.md#...
There's also a note on why not SPKI Sexps here: https://gitlab.com/tonyg/preserves/blob/master/preserves.md#..., but it doesn't render in the rendered markdown because there's a bug in Gitlab's markdown renderer: https://github.com/github/cmark-gfm/issues/121 (see also https://gitlab.com/gitlab-org/gitlab-ce/issues/52013)
In Preserves: An Expressive Data LanguageGitHub's CommonMark Markdown renderer is now safe by default
2 points · Open discussion