4 ms·
What is the security win you get from arena allocators?
by eklitzke 6y ago
What is the security win you get from arena allocators?
- londons_explore 6y agoBy making sure each type of C++ object is allocated in an arena, then many memory safety issues (use after free, buffer overflow) can only impact objects in the same arena. In Chromium land, they're called Partitions. That means an attacker has to find some memory safety issue and some code execution issue in the same object. They can't corrupt memory using one flaw and then get code execution by forcing another type of object to be allocated at the same place. Learn more here: https://chromium.googlesource.com/chromium/src/+/dcc13470a/third_party/WebKit/Source/wtf/PartitionAlloc.md https://chromium.googlesource.com/chromium/src/+/dcc13470a/t...