Re:Warning: Implicit Backdoor
by thegeomaster on Wednesday September 04, 2019 @03:08PM
(#20880396)
It will become positive anyhow, since malloc takes a size_t as argument. My question still stands - how is the ability to coerce a program to malloc an arbitrarily large block a backdoor?
[ Parent
| on HN ]
The caller of allocatebufs will probably expect that allocatebufs returns num * 64 bytes, but due to overflow it could return fewer. Thus, it could end up reading or writing out of bounds.