Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon. Entire thread

Stagefright or C/C++fright?

Name: Anonymous 2017-07-30 18:09

There is a technique called stagefright that can exploit a system by playing a video, but this is not an MPEG problem or any other video format problem. It's a C and C++ problem. Malformed data causes a C or C++ program to behave unexpectedly. The C and C++ languages not only cripple your mind, your operating system, and your hardware, they allow invaders to take over your machine by doing simple things like watching a video or generating thumbnails.

Name: Anonymous 2017-07-31 7:05

>The underlying attack vector exploits certain integer overflow vulnerabilities in the Android core component called "Stagefright",[6][7][a] which is a complex software library implemented primarily in C++ as part of the Android Open Source Project (AOSP) and used as a backend engine for playing various multimedia formats such as MP4 files.
>this is the reason we need rust
https://huonw.github.io/blog/2016/04/myths-and-legends-about-integer-overflow-in-rust/

"in release mode, overflow is not checked and is specified to wrap as two’s complement."
Of course the inherent safety of Rust can be turned on and...
https://users.rust-lang.org/t/disabling-arithmetic-overflow-checking/546
One test cases for the CPU is to overflow a register and make sure it sets the appropriate CPU flags. When I run this case, the program panics and I get the error: panicked at 'arithmetic operation overflowed' (rest of question is how to turn it off)

Newer Posts
Don't change these.
Name: Email:
Entire Thread Thread List