News for hackers. Stuff that matters.

A comment on Heap-based buffer overflow in Sudo. Parent comment

Re:Heap-based buffer overflow in Sudo by scatters on Tuesday January 26, 2021 @06:46PM (#25922430)
It's called AddressSanitizer. You enable it with the compiler flag -fsanitize=address. It's supported by clang, gcc and lately MSVC.
[ Parent | on HN ]
Re:Heap-based buffer overflow in Sudo by saagarjha on Tuesday January 26, 2021 @07:05PM (#25922562)
Address Sanitizer is not perfect, nor is it suitable to ship in production.
[ Parent | on HN ]
Re:Heap-based buffer overflow in Sudo by kevingadd on Wednesday January 27, 2021 @01:15AM (#25924902)
Asan binaries should never be shipped in security sensitive environments. It's not designed for that. It's unsafe.
[ Parent | on HN ]
Re:Heap-based buffer overflow in Sudo by rkeene2 on Tuesday January 26, 2021 @06:59PM (#25922525)
You shouldn't use ASan in release builds since it may have exploitable vulnerabilities.
[ Parent | on HN ]
Re:Heap-based buffer overflow in Sudo by pjmlp on Wednesday January 27, 2021 @02:19AM (#25925264)
And used by around 36% of developers that bother to answer surveys.
[ Parent | on HN ]