News for hackers. Stuff that matters.

A comment on Heap-based buffer overflow in Sudo. Parent comment

Re:Heap-based buffer overflow in Sudo by ddevault on Tuesday January 26, 2021 @07:54PM (#25922915)
Perhaps indeed! But a crucial distinction is that I consider the complexity in the langauge, compiler, and standard library to all be influences on your program's total complexity as well. Using std::List (or whatever you call it) has the same total complexity as writing your own little growable array.
[ Parent | on HN ]
Re:Heap-based buffer overflow in Sudo by roca on Tuesday January 26, 2021 @08:39PM (#25923250)
From the point of view of bugginess, complexity in the implementations of massively popular libraries is far less of an issue than code you just wrote yourself, because the code in those libraries will have received much more testing than the code you just wrote yourself. So it doesn't really make sense to just add the complexity of components up like that.
[ Parent | on HN ]
Re:Heap-based buffer overflow in Sudo by joveian on Wednesday January 27, 2021 @07:20AM (#25927324)
sudo is quite a popular utility, by the same logic it might be expected to be well tested...
[ Parent | on HN ]
Re:Heap-based buffer overflow in Sudo by swsieber on Wednesday January 27, 2021 @11:07AM (#25929941)
Yes. And I shudder to think just how many bugs there would be in a home-grown sudo replacement.
[ Parent | on HN ]