3 ms·

Indeed. For anyone still believing a NULL dereference (or any of the other UB that is in the C spec) is just a segfault, "What Every C Programmer Should Know A

by Tobu 6y ago

Indeed. For anyone still believing a NULL dereference (or any of the other UB that is in the C spec) is just a segfault, "What Every C Programmer Should Know About Undefined Behavior" is still required reading: http://blog.llvm.org/2011/05/what-every-c-programmer-should-know.html http://blog.llvm.org/2011/05/what-every-c-programmer-should-... Here's how triggering UB ends up as a vulnerability: https://lwn.net/Articles/342330/ https://lwn.net/Articles/342330/

suyjuris 6y ago
> Here's how triggering UB ends up as a vulnerability To be fair, dereferencing NULL ended up as a vulnerability due to 1. the optimiser removing the subsequent NULL check, and 2. the zero page being mapped. While 1. may happen, depending on how sophisticated the compiler is, 2. was already a security issue and is 'almost always' not the case.