Re:Tell HN: C Experts Panel – Ask us anything about C
by saagarjha on Tuesday April 14, 2020 @07:27PM
(#22872692)
Misreads of much less than that have been exploitable in the past.
Re:Tell HN: C Experts Panel – Ask us anything about C
by asveikau on Tuesday April 14, 2020 @08:03PM
(#22872940)
Depends a lot on the specifics. For example heartbleed was a misread that led to the buffer being sent on the socket. And I think it was more than 32 bits. 32 bits of garbage into a log file that needs privileges to read sounds a tad less scary, but like I say, not out of the question to be harmful.
Re:Tell HN: C Experts Panel – Ask us anything about C
by memling on Tuesday April 14, 2020 @08:54PM
(#22873265)
> Depends a lot on the specifics. For example heartbleed was a misread that led to the buffer being sent on the socket. And I think it was more than 32 bits. 32 bits of garbage into a log file that needs privileges to read sounds a tad less scary, but like I say, not out of the question to be harmful.
If you can do it a lot of times, though, that changes matters.
I am not sure if a segfault is always the worst case. It could be by some coincidence that array[i] contains some confidential information [maybe part of a private key? 32 bits of the user's password?] and you've now written it to a log file.
I know it's hard to imagine a mis-read of ~32 bits would have bad consequences of that sort, but it's not out of the question.