New fuzzing tool finds USB bugs in Linux, Windows, macOS, and FreeBSD

Re:New fuzzing tool finds USB bugs in Linux, Windows, macOS,... by cesarb on Thursday May 28, 2020 @11:01AM (#23338095)

> In practice, a NULL dereference in C is almost always "just" a crash that can't be turned into something worse

No, in C a NULL pointer dereference is not a crash, it's undefined behavior (which yes, can manifest as a crash), which is much more unpredictable.

[ Parent | on HN ]

Re:New fuzzing tool finds USB bugs in Linux, Windows, macOS,... by Tobu on Thursday May 28, 2020 @03:22PM (#23341305)

Indeed.

For anyone still believing a NULL dereference (or any of the other UB that is in the C spec) is just a segfault, "What Every C Programmer Should Know About Undefined Behavior" is still required reading:

http://blog.llvm.org/2011/05/what-every-c-programmer-should-...

Here's how triggering UB ends up as a vulnerability:

https://lwn.net/Articles/342330/

[ Parent | on HN ]

Re:New fuzzing tool finds USB bugs in Linux, Windows, macOS,... by suyjuris on Thursday May 28, 2020 @05:16PM (#23342760)

> Here's how triggering UB ends up as a vulnerability

To be fair, dereferencing NULL ended up as a vulnerability due to

1. the optimiser removing the subsequent NULL check, and

2. the zero page being mapped.

While 1. may happen, depending on how sophisticated the compiler is, 2. was already a security issue and is 'almost always' not the case.

[ Parent | on HN ]