Catching integer overflows with template metaprogramming (2015)

Re:Catching integer overflows with template metaprogramming ... by staticassertion on Sunday March 26, 2017 @09:03PM (#13964360)

That's a pretty impressive response - committing to fuzzing with AFL, improving current fuzzing test coverage, adding new coding guidelines, and a paid security audit.

In regards to 4 (valgrind) perhaps utilizing other sanitizers would be a good idea.

Awesome that they tested whether those methods would actually have caught this bug - and multiple did. That's a smart metric.

And a writeup about TMP and compile time safety to boot.

I'm struggling to come up with anything more that I'd want in a disclosure.

[ Parent | on HN ]

Re:Catching integer overflows with template metaprogramming ... by kentonv on Sunday March 26, 2017 @09:19PM (#13964425)

https://twitter.com/BenLaurie/status/575079375307153409 :)

The sad part of the story is that Cap'n Proto actually hasn't had a release since then, so (so far) I've effectively gotten out of doing any of those release-oriented things I promised. Many changes have gone into git master, but Sandstorm used git master directly, meaning there wasn't sufficient incentive to do the work of a release. (And as an understaffed startup we could never quite justify spending the time.)

The good news is that I joined Cloudflare two weeks ago, who is a big Cap'n Proto user, and it looks like I'll have more time and justification to do releases there. (And yes, I do intend to fulfill all the promises in doing so.)

[ Parent | on HN ]

Re:Catching integer overflows with template metaprogramming ... by staticassertion on Tuesday March 28, 2017 @10:21AM (#13976755)

> The good news is that I joined Cloudflare two weeks ago, who is a big Cap'n Proto user, and it looks like I'll have more time and justification to do releases there

That's great news, thanks for the disclaimer/ info.

[ Parent | on HN ]