5 ms·
From description of vulnerability in Linux Kernel bluetooth code: > This function receives a configuration response buffer in the rsp argument, and its length
by codedokode 9y ago
From description of vulnerability in Linux Kernel bluetooth code:
> This function receives a configuration response buffer in the rsp argument, and its length in the len argument
> Each element it unpacks from the configuration response is validated and then packed back onto a response buffer, which is pointed to by the data argument.
> However, the size of this response buffer is not passed into the function
C developers are repeating the same mistake for years. Why don't they invent some type or class for safe work with memory buffers?
- nokcha 9y agoThere have been attempts to do so. One ongoing project that looks promising is CheckedC: https://github.com/Microsoft/checkedc https://github.com/Microsoft/checkedc https://github.com/Microsoft/checkedc/releases/download/v0.6-final/checkedc-v0.6.pdf https://github.com/Microsoft/checkedc/releases/download/v0.6... https://www.microsoft.com/en-us/research/project/checked-c/ https://www.microsoft.com/en-us/research/project/checked-c/
- hossbeast 9y agoPerformance.
- nomel 9y agoHow would this be performance? Not checking a length, resulting in an overflow, should be a warning. Whatever it takes to make that happen needs to happen. This is beyond silly.
- fulafel 9y agoThis game of C vulnerabilities and patches has been going on on the Internet for 20+ years. It's largely an awareness problem, and prejudice toward safer languages.
- deleted 9y ago[deleted]