4 ms·
Sorry, but that's not true. This is still a major class of vulnerability. It doesn't necessarily have to be realloc. Here is one of many examples of an integer
by meowface 12y ago
Sorry, but that's not true. This is still a major class of vulnerability. It doesn't necessarily have to be realloc.
Here is one of many examples of an integer overflow resulting in an improper size being passed to a memory allocation function further leading to remote code execution: https://docs.google.com/document/d/1tHElG04AJR5OR2Ex-m_Jsmc8S5fAbRB3s4RmTG_PFnw/edit https://docs.google.com/document/d/1tHElG04AJR5OR2Ex-m_Jsmc8...
This one was in Mobile Chrome, discovered in 2013.
- foxhill 12y agothere is no need to apologise. if i am wrong, i am wrong. i must say, this is the first (or second..) time i've heard of such an attack. and, whilst i'm not saying you're incorrect, i will say this - if you take user input and act upon it without validation, you're going to have a bad time. realloc does exactly what it says it will do. is this a fault of realloc, or the programmer that wrote that code? my opinion is that it's a fault of the programmer. and i can already see that others disagree with that. but that's just my opinion.
- meowface 12y agoYes, it is programmer error, but the key takeaway is that it's pretty damn easy to make a subtle yet critical error when writing in C or C++. Even if you're a developer at Google and have been writing C/C++ for many years. Tools and wrappers like these try to mitigate the risk of these errors.