4 ms·
Please, it can happen in any language, it depends on how you write it. If you do not sanitize your inputs you get sql-injected, and is this fault of SQL or you?
by CSDude 13y ago
Please, it can happen in any language, it depends on how you write it. If you do not sanitize your inputs you get sql-injected, and is this fault of SQL or you? I agree it is harder to write C code safely, but this was a stupid bug, not actually a C incompetence. You could allocate a large buffer in Java, and you could use `System.arraycopy(array, 0, part, 0, size);` instead of OpenSSL: `memcpy(bp, pl, payload);` both lacks only a boundary check and language provided checks will not help you in Java. Java is given as an example language that provides boundary checks. It applies to others as well.
- prospero 13y agoSure, but that's bounded by the size of the buffer in Java. A bad boundary to the arraycopy in Java will throw an exception, not give you the contents of memory beside the buffer. These are not comparable failures.
- jibsen 13y agoAs I understood it, part of the problem was that they rolled their own memory handling which cached allocations [1]. Otherwise, I imagine system memory protection would have found this much sooner. [1]: http://article.gmane.org/gmane.os.openbsd.misc/211963 http://article.gmane.org/gmane.os.openbsd.misc/211963