2 ms·
No, it should not, because it is impossible for the check to fail in valid C. A use-after-free is invalid C. Type confusion is invalid C. If you have the funct
by geofft 5y ago
No, it should not, because it is impossible for the check to fail in valid C. A use-after-free is invalid C. Type confusion is invalid C.
If you have the function
void free_ws(struct ws *ptr) {
ptr->magic = 0xdeadc0de;
free(ptr);
}
there is no possible circumstance, in valid C, where ptr->magic could be read and have its value equal to 0xdeadc0de. That object is freed immediately after that write.
If you do a read in some other function, say
char read_from_ws(struct ws *ptr) {
if (ptr->magic != WS_MAGIC) {
exit(1);
}
return ptr->s[0];
}
it is impossible for the pointer passed into read_from_ws to be a pointer that has passed through free_ws, i.e., it is impossible for ptr->magic to have been set to 0xdeadc0de by free_ws. Therefore, free_ws doesn't need to actually do the write.
You're right that the correct magic check is not dead, and cannot be eliminated by the same logic. But the effect there is that the magic check always succeeds!
- vlovich123 5y agoIf you compile with LTO the compiler will see through your obfuscation. Play dangerous games assuming the compiler is stupid, win dangerous prizes.