Re:Getting Past C
by the_why_of_y on Wednesday January 04, 2017 @05:41PM
(#13322801)
Which common C compiler has a production quality implementation of array bounds checking?
Before you say Address Sanitizer you should be aware that its authors intended it as a debugging tool and recommend against using it in production as it introduces new attack surface, as described in the "Address Sanitizer local root" mail.
Before you say Address Sanitizer you should be aware that its authors intended it as a debugging tool and recommend against using it in production as it introduces new attack surface, as described in the "Address Sanitizer local root" mail.
http://seclists.org/oss-sec/2016/q1/363