4 ms·
i've never seen a double increment exploited before- it's undefined behavior, but what is the typical route against that?
by airza 9y ago
i've never seen a double increment exploited before- it's undefined behavior, but what is the typical route against that?
- pjmlp 9y agoUse a memory safe language that doesn't require direct pointer manipulation to access string and memory buffers, with an optimizer able to elide bounds checking if proven safe to do so.
- mikeash 9y agoThe double increment itself isn't undefined behavior. Note that the two increments were separated with a semicolon, making them separate statements. It's equivalent to pzs_text += 2;. The exploit would presumably involve structuring your data so that the excess increment skips over a terminator of some sort. If it's scanning until it hits a zero byte, and you get it to skip over the zero byte, then you have a buffer overflow.
- airza 9y agoAhh, that does make sense, i didn't see that.