C-to-Rust Tools Fail to Compile 342 of 464 Translations and Carry Over Memory Bugs in 177
arXiv·high signal
Chen et al. ran C2Rust-analyze, CROWN, C2SaferRust and FLOURINE, including LLM-based approaches, on 116 NIST Juliet C programs with known memory-security bugs. Of the 464 Rust outputs, 342 did not compile, 177 inherited the original C memory bug, and 77 introduced new Rust bugs. The authors conclude that the tools meet their own definition of memory safety, meaning less unsafe Rust, but not memory security. Don't treat less unsafe code as a security result without re-running the original bug's test.