[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 15 Oct 2014 11:30:08 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Thoughts on Shellshock and beyond
On 10/14/2014 11:45 PM, David A. Wheeler wrote:
> The most obvious example of an underused tool is memory-safe languages.
> Shellshock would not have been countered by them,
> but Heartbleed (and many others) *would* have been countered.
Buffer reuse is common in languages with memory safety (so that I/O
throughput is not bounded by garbage collector throughput). The impact
is reduced (you only leak prior buffer contents, whatever that might be,
not anything which happens to be in the vicinity on the heap). But I
don't think it's true that memory safety prevents such information leaks.
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
