4 ms·
unsafe code is not required or used. The exploit constructs a confused interface value, whose vtable refers to a different type than is what is stored. The resu
by millstone 9y ago
unsafe code is not required or used. The exploit constructs a confused interface value, whose vtable refers to a different type than is what is stored. The result is that Go treats an integer as a function and jumps to it.
The unsafe address() is used to get the address of a function to store in the int, to demonstrate the potential for shellcode injection. But you could just as easily assign pp := 12345 and produce a SIGSEGV or SIGILL, which would not be possible if Go were memory safe.
- deleted 9y ago[deleted]
- pjmlp 9y agoOn the contrary, if Go was unsafe that would just corrupt memory and the program would just carry on without anyone noticing the memory was corrupted until it was too late, in another completely different stack. The exploit was only possible thanks to using the unsafe package, even if indirectly. It is exactly because Go is memory safe that a SIGSEGV or SIGILL is produced the exact moment the memory gets corrupted and not 2 hours later in a complete different stack trace.