C-to-Rust translation tools fail to compile most test programs

Four C-to-Rust translation tools turned 116 known-vulnerable C programs into 464 Rust outputs, and 342 of them failed to compile at all. That failure rate matters because these tools get pitched as an automatic route to memory safety for legacy C code. This test suggests most attempts don't even produce working software, let alone secure software.

The researchers ran C2Rust-analyze, CROWN, C2SaferRust and FLOURINE, including LLM-based approaches, on C programs from NIST's Juliet suite of known memory bugs.

Among the translations that did compile, 177 still carried the exact memory bug from the original C source. Another 77 introduced new bugs that weren't in the C code, per the Juliet-benchmark evaluation.

The authors say the tools meet their own definition of memory safety, meaning less unsafe Rust code. Memory security is a separate claim, and meeting the first doesn't guarantee the second.

A clean compile isn't a security signal. Re-run the original bug's test case against the translated Rust before deciding anything is fixed.