News for hackers. Stuff that matters.

A comment on BearSSL – Smaller SSL/TLS. Parent comment

Re:BearSSL – Smaller SSL/TLS by usefulcat on Thursday November 03, 2016 @02:05PM (#12866376)
Not using the heap != everything is allocated on the stack. In situations where you want to avoid dynamic allocation, memory for most things that would otherwise have been dynamically allocated ends up being statically allocated at compile time.
[ Parent | on HN ]
Re:BearSSL – Smaller SSL/TLS by sigjuice on Thursday November 03, 2016 @03:41PM (#12867265)
Absolutely none of this is immune to buffer overflows.
[ Parent | on HN ]
Re:BearSSL – Smaller SSL/TLS by usefulcat on Thursday November 03, 2016 @04:49PM (#12867816)
No, but you're a lot more likely to be able to overwrite the return address via a stack-based buffer overflow, and that is generally a much more serious kind of attack.
[ Parent | on HN ]