4 ms·
Seems like the high-level lesson is that tagged unions as traditionally implemented can be vulnerable in a manner that pointer/address-focused mitigations don’t
by twoodfin 6y ago
Seems like the high-level lesson is that tagged unions as traditionally implemented can be vulnerable in a manner that pointer/address-focused mitigations don’t affect?
- tlb 6y agoIndeed, a small integer tag seems much more vulnerable than a C++ virtual table pointer. On modern hardware, how much is the penalty for using magic numbers instead of small indices? (A magic number meaning a constant like 0x85adb9ad instead of 2). The compiler can't optimize switch(it->type) using a jump table, but I suspect that branch prediction and speculation makes this optimization barely relevant.
- kevincox 6y agoA jump table isn't likely used for very small unions anyways. The biggest downside that I see is that comparing with zero is slightly cheaper if that is a common value.
- saagarjha 6y agoAt the very end, there is speculation that things like this might get manual inclusion in these mitigations grounded in parts of Ivan Krstić's Black Hat talk from last year.