4 ms·
Object pools don’t turn off by one errors into complete remote code execution exploits.
by Too 5y ago
Object pools don’t turn off by one errors into complete remote code execution exploits.
- AnIdiotOnTheNet 5y agoHow does a GC help with that? That's just boundary checking.
- Too 5y agoJust? :) And don’t forget about all the other ways such corruption could happen, use after free etc. On top of all that, in managed languages you generally have a stronger runtime type information on top, that doesn’t accept arbitrary memory address to implicitly be read as executable code. Even explicit static casts from Object to more defined type will fail if the object is not of expected type. Code must be defined as function objects in the language to begin with.
- AnIdiotOnTheNet 5y agoObject pooling without GC has the same use-after-free problem as with it.