Unpatched Firefox flaw may expose users

TalkBack 43 of 166:

Next »

« Previous

• Thread View
• Flat View

...

"How does hardware know the buffer size?"
It does not.

"I guess if the architecture separates the data stack from the executeable code stack you'd be ok."
It does.

"(But I would not want to rely on this mechanism)"
And why not?

"But, still, if I allocate a chunck of memory, how does the hardware know if I want to write data or executeable code to that block of memory?"
Because the OS tells it when the page tables are initialized. A special bit in the page table privilege mask informs the MMU as to whether or not the memory page is executable. If it is not, no code may be run off that page, and the result is an access violation. Look up Data Execution Prevention.

"It is the programmers responsibility to write good code."
Obviously, which is why one of the solutions is to not make the mistake in the first place.

"Buffer overflows are not a new phenomenum."
Obviously.

"Some OS's are better at providing protection against these types of attacks" All modern OS's implement memory protections. No OS can protect against a buffer overflow without either emulating the code, monitoring the code, rewriting the code, or using hardware features.

"I also disagree about the speed comment, as properly structured code tends to run quite well." Yes. But we're not talking about properly structured code--we're talking about already bad code that you claim the OS has to fix. But the OS cannot fix it without either hardware support or drastic slowdowns.

"The fastest code in the world doesn't matter if it is buggy or causes problems." Not true. Consider the time wasted by a slower browser versus the value of the info on your computer. For many people, a fast, insecure browser is better than a slow, secure browser for this very issue--they can't or don't want to wait.

"Just how fast does a browser need to be anyway? You still spend more time waiting for the HTML to be served to the browser than anything else." Not really. I'm on broadband. About 10% of the time, I'm waiting on the rendering engine, not the web server. How can I tell? Zero network traffic and 100% CPU usage.

Posted by: PeregrineFalcon   Posted on: 09/09/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now
• Email Security and Archiving - Clearer in the Cloud Google The time is NOW for businesses and organizations of all sizes to implement ... Download Now
• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now