3 ms·
Also because the 'safe' version only checks dict->pos == dict->limit and not dict->pos >= dict->limit if you can get one call of dict_put somewhere to p
by justinsaccount 3y ago
Also because the 'safe' version only checks
dict->pos == dict->limit
and not
dict->pos >= dict->limit
if you can get one call of dict_put somewhere to pass the limit, all later calls of dict_put_safe will happily overwrite memory and not actually be safe.
- ahartmetz 3y agoWow, that is 1000% obviously malicious
- Calzifer 3y agoNo, because dict_put will update the limit value if the new pos exceed it.
- justinsaccount 3y agoI don't see anything like what you are describing. What line exactly are you talking about?