4 ms·

https://org.cs.pub.ro/dragos.tarcatu/llvmlinux/commit/058504edd02667eef8fac9be27ab3ea74332e9b4 https://org.cs.pub.ro/dragos.tarcatu/llvmlinux/commit/058504...

https://org.cs.pub.ro/dragos.tarcatu/llvmlinux/commit/058504edd02667eef8fac9be27ab3ea74332e9b4 https://org.cs.pub.ro/dragos.tarcatu/llvmlinux/commit/058504... m->size must be of type size_t. It's slightly mind-blowing to me that casting to a smaller unsigned int can cause a vulnerability. But I guess unintended behavior (not undefined) can do that.

anyfoo 5y ago
It's very common. All that needs to happen, as just one example, is the variable of the smaller type being used as an index into an array. You might get an out of bounds access, or even just an access to the wrong element.
- anyfoo 5y ago
  To add to my own comment, more realistically this happens if the variable is used in the calculation of an index, rather as directly as the index. Though if the array is sufficiently large, and/or the smaller type sufficiently small (short or even char, which are most often 16 or 8 bit nowadays), then at least accessing the wrong element is still common (out of bounds less so). Well, you get the overall idea.