This is the mail archive of the gcc@gcc.gnu.org mailing list for the GCC project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]

Re: Buffer Overflow Attacks


> Date: Thu, 18 Oct 2001 15:02:24 -0700
> From: Michael Eager <eager@mvista.com>
> To: Florian Weimer <fw@deneb.enyo.de>
> CC: "Joseph S. Myers" <jsm28@cam.ac.uk>, gcc@gcc.gnu.org

> I think that this is stretching reading of this paragraph.  Creating
> a valid pointer address does not mean that deferencing the pointer is
> defined.

Well, I can't comment on the exact code you gave, but I can comment on
C++ and code like this:

struct foo {
  char c[31];
  int i;
} f;

  *(((char*)&f)+32) and *(((char*)&f)+33) are allowed.

C must have the same rules for this case.  If they don't they got it wrong.

> Referencing these padding bytes is undefined.

Nope.  See above.  Let's suppose that there are 16 bytes of padding in
there.  The two expressions about, must work.

> Indeed, in a hypothetical processor with very fine grained memory
> protection, any padding bytes placed between c and i in the struct
> may be both unreadable and/or unwritable.

Nope.  Cannot be done in C++.  If C doesn't say this, it is wrong.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]