That jibes with my knowledge.
But I've seen some real weird stuff before. ;) Folks using variable-length fields and happily just dumping the contents into eval(), all sorts of awful.
But I've seen some real weird stuff before. ;) Folks using variable-length fields and happily just dumping the contents into eval(), all sorts of awful.
I am far from an expert in security but I've done a bit of reversing/hacking when I was 16 years old (DOS era)
I think this is hard to check for everything, but in my opinion, good security can be achieved with extreme simplicity.
Packets are fixed-size, every fields are manually bound checked and the packet is rejected if anything looks wrong.