Me: OpenSSH is one of the most secure apps ever written, even in C C Haters: no it’s not! Several RCE bugs! Me: prove it. Show me a working exploit. *crickets* FUD and Security pedanticism is unbecoming of our insustry, Pals.
-
-
I’m one of the best when it comes to finding 0day in C. :) but I know it’s easy now, to write safe C. You can disagree all you want, but the tools and mitigation’s are available. Our industry failure is not making access simple and straight forward.
-
#define SIZE 8192 char buf[SIZE]; void cpy(struct foo* p, int count) { int n = count * sizeof(struct foo); if ((n < SIZE) && (n > 0)) memcpy(buf, p, n); } Safe or not? Why? How many people can spot this? Which tools? Far from easy. -
Creating situations that are easily avoidable doesn’t prove your point, it proves mine. :)
-
What about the situation in the above code is easy to avoid? I've shown the snippet to rooms full of people who do code audits for a living. Maybe 1 in 30 even gets what the problem is. Regular engineers? Zero out of 30.
-
That’s total nonsense. No one that does professional code auditing would miss that. It’s the most basic C issue. I feel like you’re just trying hard to make your point. There are far more serious undefined issues. Evading this is cake.
-
A majority of my public exploits since ~2005 have come from this class. See the LZ4/LZO bug from 2014 as an example.
-
*COUGH*INDUSTRYFULLOFCHARLATANS*COUGH* Computers are magic rocks that we tricked into counting time and doing math really fast with lightning.

-
Worse issue: evaluate pointer arithmetic in kernel land and tell me if the kernel can correctly verify whether a pointer will be dereferenced in userland or kernel land ;)
- 2 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.