3 ms·
To provide a little bit more context, here is detailed description of this bug [0]. Curiously, they suggest that problem could be avoided by changing the check
by wuch 9y ago
To provide a little bit more context, here is detailed description of this bug [0].
Curiously, they suggest that problem could be avoided by changing the check for EOF to ">=".
This is not true at all in case of C, at least as far as language semantics is concerned.
When pointer goes two past the end of array you are already in undefined behaviour land.
[0] https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/ https://blog.cloudflare.com/incident-report-on-memory-leak-c...
- striking 9y agoMore specifically: > The Ragel code we wrote contained a bug that caused the pointer to jump over the end of the buffer and past the ability of an equality check to spot the buffer overrun.
- ioquatix 9y agoI think it's valid in C/C++ to go 1 past the end of an array: https://stackoverflow.com/questions/988158/take-the-address-of-a-one-past-the-end-array-element-via-subscript-legal-by-the https://stackoverflow.com/questions/988158/take-the-address-...