...
Code Block | ||||
---|---|---|---|---|
| ||||
struct big { unsigned long long ull_1; /* typically 8 bytes */ unsigned long long ull_2; /* typically 8 bytes */ unsigned long long ull_3; /* typically 8 bytes */ int si_4; /* typically 4 bytes */ int si_5; /* typically 4 bytes */ }; /* ... */ int f(void) { size_t skip = offsetof(struct big, ull_2); struct big *s = (struct big *)malloc(sizeof(struct big)); if (!s) { return -1; /* HandleIndicate malloc() errorfailure */ } memset(s + skip, 0, sizeof(struct big) - skip); /* ... */ free(s); s = NULL; return 0; } |
A similar situation occurred in OpenBSD's make
command [Murenin 2007].
...
Code Block | ||||
---|---|---|---|---|
| ||||
struct big { unsigned long long ull_1; /* typically 8 bytes */ unsigned long long ull_2; /* typically 8 bytes */ unsigned long long ull_3; /* typically 8 bytes */ int si_4; /* typically 4 bytes */ int si_5; /* typically 4 bytes */ }; /* ... */ int f(void) { size_t skip = offsetof(struct big, ull_2); struct big *s = (struct big *)malloc(sizeof(struct big)); if (!s) { return -1; /* HandleIndicate malloc() errorfailure */ } memset((char *)s + skip, 0, sizeof(struct big) - skip); /* ... */ free(s); s = NULL; return 0; } |
Risk Assessment
Failure to understand and properly use pointer arithmetic can allow an attacker to execute arbitrary code.
...