4 ms·
What could happen if these 10KiB blobs landed on maliciously crafted data? What could happen if the difference between two blobs was a maliciously chosen value?
by CompuHacker 6y ago
What could happen if these 10KiB blobs landed on maliciously crafted data? What could happen if the difference between two blobs was a maliciously chosen value?
- fishywang 5y agoMy code only use the 10KiB blobs for comparison, so as long as I don't have any buffer overflow bugs the actual content doesn't matter. Even if I had a buffer overflow bug, I'm running the code through Docker with distroless based image [0], so that helps a little as well. I guess I can also change docker's runtime from runc to runsc [1] to help mitigate further, but I don't really see that as necessary as it's quite hard to have buffer overflow bugs in go code. [0]: https://github.com/GoogleContainerTools/distroless https://github.com/GoogleContainerTools/distroless [1]: https://gvisor.dev/docs/user_guide/quick_start/docker/ https://gvisor.dev/docs/user_guide/quick_start/docker/