News for hackers. Stuff that matters.

A comment on Log4j RCE Found. Parent comment

Re:Log4j RCE Found by rixed on Saturday December 11, 2021 @02:24AM (#29519211)
How are varargs implemented in the JVM ABI? Is the called function even aware of how many parameters were actually passed, or does it have to rely on the format string for that?
[ Parent | on HN ]
Re:Log4j RCE Found by jameshart on Saturday December 11, 2021 @11:54AM (#29522277)
Turned into an object[] array.

The log4j API implements a few overloads of each log method to help avoid the implicit array allocation happening in common logging cases (no args, one arg, etc).

The call site can tell if args were provided.

[ Parent | on HN ]