4 ms·
So fixing approx. 5-10% of CVEs (by zero-initializing all stack vars) is a worse cure than letting these uninitialized stack vars be possible sources of exploi
by canucker2016 1y ago
So fixing approx. 5-10% of CVEs (by zero-initializing all stack vars) is a worse cure than letting these uninitialized stack vars be possible sources of exploits?
see https://msrc.microsoft.com/blog/2020/05/solving-uninitialized-stack-memory-on-windows/ https://msrc.microsoft.com/blog/2020/05/solving-uninitialize...
Initializing the stack var to zero would have helped mitigate the recently discovered problem in GTA San Andreas (the real problem is an unvalidated data file) - see https://cookieplmonster.github.io/2025/04/23/gta-san-andreas-win11-24h2-bug/ https://cookieplmonster.github.io/2025/04/23/gta-san-andreas...
- Arnavion 1y ago>So fixing approx. 5-10% of CVEs (by zero-initializing all stack vars) is a worse cure than letting these uninitialized stack vars be possible sources of exploits? Read the comment you responded to again, carefully. It's not presenting the dichotomy you think it is.