Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera...
by jjnoakes on Wednesday October 05, 2016 @08:07AM
(#12643113)
Since you are generating the C code, you can generate the appropriate checks where needed to avoid such undefined behavior too.
[ Parent
| on HN ]
Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera...
by MaulingMonkey on Wednesday October 05, 2016 @08:56AM
(#12643370)
Which is the one thing keeping it in the running.
The problem is this line of reasoning doesn't generally hold up when applied to C codebases (because in practice statistics catches up with you eventually) and C code generators, in effect, happen to contain an admittedly small but rather obfuscated C codebase.
Moreover, you must always include such checks - manually crashing on e.g. null pointers even if you'd be entirely satisfied with a segfault - just to avoid the optimizer potentially going apeshit on your code. Which can have... poor effects on program performance.
Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera...
by jjnoakes on Wednesday October 05, 2016 @02:31PM
(#12646479)
If you are writing a code generator, it all depends on the source language. If, for example, your source language doesn't have NULL pointers, then you don't have to waste cycles checking them in C.