Hacker News new | ask | show | jobs
by E6300 3410 days ago
This? http://blog.regehr.org/archives/970

The compiler didn't create a security bug by removing the null check. The bug was created by the programmer when he didn't check for null before dereferencing the pointer. Even with the check, the program contained a bug.
1 comments
vyodaiken 3410 days ago
The compiler converted a buggy program that was prevented from opening a security hole by defense in depth into a program with a security hole. It transformed a careless error into a systemic error, all in the cause of a micro-optimization that didn't.
link
E6300 3410 days ago
What are you talking about? Dereferencing invalid memory is a security bug.
link
vyodaiken 3410 days ago
Not necessarily.
link
E6300 3410 days ago
In what cases it's not?
link
vyodaiken 3409 days ago
In the referenced case the introduced error involved a reference to a null pointer but there was still no exploitable security hole. The exploit was enabled when the compiler removed an explicit check. The null dereference was an error, but it was not a security issue on its own.
link
E6300 3409 days ago
Why didn't the kernel panic when it tried to access NULL?
link