US-CERT Vulnerability Note VU#162289

[Rupert Wood]

Nicola Musatti wrote:

> _main	PROC
>
> ; 12   : 	char * b = "0123456789";
> ; 13   : 	for ( int l = 0; l < 1 << 30; ++l )
> ; 14   : 		f(b, l);
> ; 15   : }
> 
> 	xor	eax, eax
> 	ret	0
> _main	ENDP

Note that it optimised away your whole program! It could blank out f() because it never needed to call it. Try marking it __declspec(dllexport) and you'll see it *does not* get optimised away.

That said, from my experiments VC will optimise f() away to 0 when inlining it.

Rupert.