Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This testing-based approach is great at finding buffer overflows that occur within your test suite. But especially for code like curl that runs on untrusted data, you need a more adversarial mindset. Unless your tests cover every possible input, a clever attacker might always find input data that you didn't think to test.


Here's an example from one of your own projects, where code that works fine on normal input has a buffer overrun on malicious or corrupted data:

https://github.com/quelsolaar/HxA/issues/4




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: