On 2026-01-11 21:09:55 -0600, Jacob Bachmeyer wrote: > Aside from the dubious patch, this is a good example of a legitimate bug but > bogus CVE: how exactly does an attacker trigger this without either having > *already* completed a DoS attack (consuming all memory) or achieved > arbitrary code execution (altering the allocator to return NULL even though > memory is available)? > > In short, this is a crash bug, but not a security issue. This is different > from (for example) a parser bug that results in NULL being dereferenced if > crafted input is processed.
Note that according to the C standard, dereferencing a null pointer is undefined behavior, not necessarily a crash. This means that due to compiler optimizations, unexpected code might be run with uncontrollable behavior. And it may be difficult to prove that the code is actually safe despite the optimizations. -- Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
