3 ms·

I can't comment on his assessment, but here is what Dan Luu says: http://danluu.com/integer-overflow/#fnref:H http://danluu.com/integer-overflow/#fnref:H

• jerf 10y ago
  Based on discussions I've had here, I do agree that step one is just for more people to care. If more people care, it will eventually get the attention of hardware people. I mostly care about this issue because of the security issues that arise (overflow is somewhere around #4 or #5 on the list of top root causes of security issues), and for all that a lot of programmers think they care about security, there's still a lot of programmers that are quite cavalier about fixing the root causes of these issues rather than occasionally fixing symptoms when you think of it.
  • pcwalton 10y ago
    > I mostly care about this issue because of the security issues that arise (overflow is somewhere around #4 or #5 on the list of top root causes of security issues) How many of those overflow issues crucially have to be combined with memory safety problems to be weaponizable? I suspect the ratio is over 95%.
    • jerf 10y ago
      I do also care about the correctness issues. It's hard to write correct software on top of a foundation that will happily tell you that 130 + 130 = 4. There's a fundamental mismatch between what people think the operation means, and what it really means, and that's never a good thing.
    • deleted 10y ago
      [deleted]