Похожие чаты

Q: Is it a bug? A: Yes, it can be categorized

as buffer overflow vulnerability.

Q: Why doesn't it crash?
A: Dereferencing wild pointer is like opening a box of chocolate, you never know what you're gonna get!

Q: Be more specific!
A: When compiled in debug mode, allocator try to allocate the memory block at the end of a page, and mark the next page as nonwritable. For example, if you allocate 16 bytes, the allocator may place it at 4095 - 16 = 4079. When you write the 16th byte (4096), which resides in the next non-writeable page, hardware notice the OS that your program is malfunctioning.

Q: Why is my bug (malloc(5) and accessing [13]) not detected?
A: Unaligned memory access slows down the program; on some platforms, the program will even crash! Memory allocators tend to align the returning address to prevent such tragedy. On x86_64, my allocator (ptmalloc2 by glibc) aligns the address to a multiple of 16 bytes. So if you allocate 5 bytes, instead of returning 4095 - 5, the allocator returns 4095 - 16. Now you have to access 16 bytes past the returning address to trigger the protection.

Q: How can I detect the bug?
A: Use awesome tools, like ASan in Clang and Valgrind.

3 ответов

3 просмотра

amazing

Похожие вопросы

Обсуждают сегодня

Ясн. Но я всеравно к кедам отношусь с опасением. Чисто субьективное кедосозерцание. Что касаемо "восторга изяшности кед" так и не вкурил, хотя много слышал, пока не поставил с...
Артем Записной
30
Такой вопросец - есть функция function MySuperDuperConcat(const a: array of AnsiString): AnsiString; Как мне в её теле сделать вот так? Result:=Concat(a); А не грустный вариан...
notme
15
type TObj = object procedure Init; virtual; end; TObj1 = object(TObj) procedure Init; override; end; procedure TObj1.Init; begin inherited; end; procedur...
Alexander 👋
29
They keep hyping $FUN but where's the progress? 🙄
Noah Noure
23
Есть какой-нибудь для Delphi/FPC T*Compression(Decompression)Stream на базе LZ4/Zstd/любой другой быстрый(и хорошо сжимающий) алгоритм А ещё лучше в pure pascal А ещё лучше од...
notme
48
Btw guys very stupid question but i haven't researchd so js asking you pros . Can ltc be traced too? Literally point to pint to the user? And getting the banks blocked ? Exch...
20
А чем вам питонисты не угодили?😂
.
79
Hey guys, did you see the new announcement about $Fun? 🔥
Filip Murphy
55
How can a minority hashrate chain defend from a fork-hopping ASIC miner? The problem: 1. A miner comes into your network, and mines at 60-70% hashrate. 2. After some time, th...
Kishniev
13
yeap, thanks guys for response, but I really like to understand does a pool created on curve.fi has the option or api or I can call a function of a smart contract to set excha...
Oleg Karoza
11
Карта сайта