Re: Interesting coding tidbit

From: Larry Kilgallen (Kilgallen_at_SpamCop.net)
Date: 12/17/04

  • Next message: david20_at_alpha2.mdx.ac.uk: "Re: Time to revive Emerald?" 
    Date: 17 Dec 2004 04:12:39 -0600

    In article <cpu724$7r$1$8300dec7@news.demon.co.uk>, Chris Sharman <chris.sharman@sorry.nospam> writes:
    > Keith Cayemberg wrote:
    >
    >> John Smith wrote:
    >>> http://www.research.ibm.com/trl/projects/security/ssp/
    >>
    >> Of course this does nothing for you if the Hacker/Cracker used GCC
    >> without this extension, another language's compiler, assembler or even
    >
    > Am I missing something ?
    > I thought this was a feature to protect your own trusted code against
    > buffer overrun attacks, rather than to stop hackers compiling virii ?

    Certainly you are correct. There is no protection if you give an
    attacker permission to execute their own code on your machine.

    > Although I agree there's no substitute for correct code, if it offers
    > buffer protection it probably makes writing correct code easier.

    It is important to note that this is _not_ a general GCC feature.
    The cited page notes that it is _specifically_ for programs that
    are written in C.

    For general programming purposes, buffer overflows were conquered
    years ago -- only lower level languages like C* have this problem.

  • Next message: david20_at_alpha2.mdx.ac.uk: "Re: Time to revive Emerald?"

    Relevant Pages

    • Re: Anti-Shock protection
      ... Some notebooks have this feature, ... If the laptop has no the HDD anti-shock protection, is this serious drawback, or its not very important? ... Drives are also sensitive to vibration, ...
      (microsoft.public.windowsxp.hardware)
    • Re: Language features worth proposing
      ... Some directive to disallow implicit external procedures. ... one could argue that a compiler flag to do this is ... partly because string conversion is 'fuzzy'. ... for some pet feature to be added. ...
      (comp.lang.fortran)
    • Re: Why is it dangerous?
      ... When I compile a program from our C course with a windows compiler ... Is linux more dangerous than windows? ... to the first character in a buffer, and stores an entire line from stdin ...
      (comp.lang.c)
    • Re: cast-as-lvalue (Thank You)
      ... other type -- pointing into the buffer, ... Of course, this fails to compile cleanly in any correct C compiler, ... the resulting machine code (on the SPARC or MIPS ... Of course, even this shorter version still generally fails at runtime, ...
      (comp.lang.c)
    • Re: c++ interpreter
      ... I didn't say it wasn't a feature. ... the setup to the bug ... - Automatically Execute tests on Save ... > unless your compiler builds an executable w/ errors, ...
      (comp.lang.cpp)