News for hackers. Stuff that matters.

A comment on Heap-based buffer overflow in Sudo. Parent comment

Re:Heap-based buffer overflow in Sudo by gpm on Tuesday January 26, 2021 @07:47PM (#25922877)
It's within the C and systemv abi specs, but it's not within the implicit contract of how you call command line programs. I'm fine with it.
[ Parent | on HN ]
Re:Heap-based buffer overflow in Sudo by ddevault on Tuesday January 26, 2021 @08:01PM (#25922967)
Right, but if it was within the specs, possible to craft a scenario for, and leads to a security vulnerability, then does it suddenly matter? A bug is a bug. If it doesn't matter for Rust then it doesn't matter for C.
[ Parent | on HN ]
Re:Heap-based buffer overflow in Sudo by gpm on Tuesday January 26, 2021 @08:25PM (#25923136)
> and leads to a security vulnerability

I have trouble imagining how aborting leads to a security vulnerability? That's literally running no code, the opposite of running arbitrary code.

Aborting is fine in any language. Criticisms of C here would come about because C doesn't abort when it should (null pointer deref, array out of bounds, etc), not the inverse.

[ Parent | on HN ]