Re:Vulnerable industrial controls directly connected to Inte...
by cesarb on Monday January 29, 2018 @04:55PM
(#16260976)
> You can't overflow a vector. It's not a fixed size array. It grows automatically as needed.
His example shows the precise opposite: the vector didn't grow automatically. Instead, memory outside the vector bounds was accessed, i.e., the vector overflowed.
Yes, idiomatic modern C++ makes that less likely, by reducing the use of explicit indexes. Even then, you still can overflow a vector with innocent-looking code.
Re:Vulnerable industrial controls directly connected to Inte...
by thriftwy on Monday January 29, 2018 @04:53PM
(#16260958)
> that is undefined behavior and is documented
In C, buffer overruns are undefined behavior and are documented. Back to square 1.
Re:Vulnerable industrial controls directly connected to Inte...
by spc476 on Monday January 29, 2018 @05:00PM
(#16261014)
But can the compiler warn about such undefined behavior? Because if it can't, it's not much better than C.
Re:Vulnerable industrial controls directly connected to Inte...
by tonyarkles on Monday January 29, 2018 @05:08PM
(#16261079)
I just tried:
g++ -Wall -pedantic vec.cpp
What your example shows is an attempt to access a vector element that does not exist (std::out of range). And, that is undefined behavior and is documented.
Also, that code is 95% C (not C++). Even the includes and prints are C. Pure, idiomatic C++ would use iostream rather than stdio.h, and a vector iterator to access the elements rather than looping over the vector (in C like fashion) using an integer (which is unrelated to the vector) in an effort to access elements via index.