[OffTopic] A vulnerability postmortem on Network Security Services
j at j.nl
Thu Dec 2 12:15:38 UTC 2021
On Thursday, 2 December 2021 at 11:01:07 UTC, Imperatorn wrote:
> On Thursday, 2 December 2021 at 08:09:18 UTC, Paulo Pinto wrote:
>> Google's Project Zero goes through a memory corruption exploit
>> on Network Security Services, where despite all static
>> analysers, fuzzers and code reviews, it flew under the radar.
>> Hence why @safe matters.
> Bottom line:
> Use D instead of C 😎
Sorry to rain on the party here, but D is of course not at all
immune to this problem.
It was not hard to find out-of-bounds memory access in the D
compiler, using the fuzz techniques mentioned in the article.
Note the discussion of bounds checking in the PR...
More information about the Digitalmars-d