News for hackers. Stuff that matters.

A comment on Serious Chrome zero-day. Parent comment

Re:Serious Chrome zero-day by dymk on Wednesday March 06, 2019 @08:10PM (#19324729)
Can you use the STL? What boundary is considered trusted?
[ Parent | on HN ]
Re:Serious Chrome zero-day by chii on Thursday March 07, 2019 @09:34PM (#19334643)
The point i was making is that such boundary doesn't exist - no one can write everything "on their own".

Therefore, language features to prevent a class of exploits should be a high priority when considering a project.

[ Parent | on HN ]
Re:Serious Chrome zero-day by Agathos on Wednesday March 06, 2019 @08:21PM (#19324776)
I can trust the compiler... I hope?
[ Parent | on HN ]
Re:Serious Chrome zero-day by stcredzero on Wednesday March 06, 2019 @08:24PM (#19324799)
Hope...

https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...

[ Parent | on HN ]
Re:Serious Chrome zero-day by pjmlp on Thursday March 07, 2019 @02:43AM (#19326258)
Not at all, check the Linux 5.0 bug introduced by a gcc "optimization" regarding UB.
[ Parent | on HN ]
Re:Serious Chrome zero-day by Miltnoid on Wednesday March 06, 2019 @08:56PM (#19324937)
Use CompCert! (And C instead of C++)
[ Parent | on HN ]