Memory safety is certainly a problem. But so is the ability to execute data. I'm scared by the use of any language that has that capability for security-critical applications.
In the last 15 or so years that awareness has increased of that issue, the defaults for stack and heap allocations are to mark pages as non-executable. It is therefore harder than it used to be to execute data - you need to jump through some hoops.
Not to mention if you could not execute data, your programs would not load.
The moment you have any kind of interpreter or JIT compiler, you're effectively bypassing non-executable protection on memory by providing a way of executing code that looks just like accessing data from the CPU's perspective.
reply