Re: US-CERT Vulnerability Note VU#162289

[Nicola Musatti <Nicola dot Musatti at gmail dot com>]

Rupert Wood wrote:
> Nicola Musatti wrote:
>
> > _main	PROC
> >
> > ; 12   : 	char * b = "0123456789"; ; 13   : 	for ( int l = 0; l < 1
> > << 30; ++l ) ; 14   : 		f(b, l); ; 15   : }
> >
> > xor	eax, eax ret	0 _main	ENDP
>
> Note that it optimised away your whole program! It could blank out
> f() because it never needed to call it.

That's true, although f() was still compiled to the equivalent of 
'return 0;'.
 This can be made more evident by changing f() to

#include <iostream>

int f(char *buf, int len) {
	int res = 0;
	len = 1 << 30;
	if (buf + len < buf)
		res =  1;
	std::cout << res << '\n';
	return res;
}

The resulting f() amounts to

std::cout << 0 << '\n';
return 0;

Which is still inlined into main().
Cheers,
Nicola
--
Nicola.Musatti <at> gmail <dot> com
Home: http://nicola.musatti.googlepages.com/home
Blog: http://wthwdik.wordpress.com/