Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)
Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)
Posted Apr 27, 2015 20:50 UTC (Mon) by paulj (subscriber, #341)In reply to: Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica) by wahern
Parent article: Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)
Oh, and on your other point. You're saying we should rely on human eyes catching bugs on parameters to memcpy's not having been checked properly earlier. We know this doesn't work.
Code that relies on humans mentally analysing C parsers of untrusted input to make sure that every bit of pointer arithmetic and memory writes that could be affected by the input will always be safe is code that will have lots of remote exploits. We know this.
If you want to make code secure, you *must* let the computer help you. Even without fancy compilers, it is still trivial for a programmer to place a simple bounded-buffer between the IO and the parser, to ensure that basic constraints like "Don't read or write outside the allocated buffer" are *ALWAYS* met OR the programme terminates *safely*.
It's trivial to do. Why not do it?