18 ms·
The idea is you have some struct that is in peril. Perhaps it will be overflowed, or used after free, etc. It has a function pointer. struct danger {
by tedunangst 7y ago
The idea is you have some struct that is in peril. Perhaps it will be overflowed, or used after free, etc. It has a function pointer.
struct danger {
sort_fn sorter;
char data[16];
};
danger->sorter(danger); /* what if it's a bad pointer? */
You replace that with this.
int add_sort_fn(sort_fn sorter) {
sort_fns[num_sorts++] = sorter;
return num_sorts;
}
struct lessdanger {
int sortidx;
char data[16];
};
danger->sortidx = add_sort_fn(sorter);
/* could clean this up a bit more */
sort_fns[danger->sortidx % num_sorts](danger);
There's still the possibility of calling the wrong function, but only one from a finite set of possibilities. There's no direct control over the pointer value.
You can make the sort_fns array resizeable, but in practice there's usually only so many targets.