Hacker News new | past | comments | ask | show | jobs | submit login

I like how I had to read 100 comments on Hacker News to learn this information. Vulnerability disclosure just isn't what it used to be.



A shame, too, because there's a (small, admittedly) lesson buried in the fix--one that can be applied even in low-level languages.

If you have a buffer with odd semantics (such as wrapping out-of-bounds addresses back into bounds), it should probably be wrapped in something that enforces that. In C++, it could be made to look like a normal buffer, except that operator[] is overloaded to wrap for you, and you can make the compiler scream at you if you try to escape that safety net--for an inline class, very likely without any performance cost over adding the wrapping computation to each access by hand.

In C, your options are more limited. The safest is an opaque handle that has to be passed to an accessor function. You're more likely to take a performance hit (unless LTO fixes it for you), but in a floppy drive emulator, I doubt it matters.

If the overhead does matter, a macro or static inline function still makes the access convention easier to memorize, which should make it less likely for someone to forget, and should make code that does forget more suspicious on code review.


The diff is literaly linked in the article.


The original site, and my comment, are from 9 days ago. The linked diff is from 7 days ago.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: