On 1/12/26 08:25, Vincent Lefevre wrote:
On 2026-01-11 21:09:55 -0600, Jacob Bachmeyer wrote:
Aside from the dubious patch, this is a good example of a legitimate bug but
bogus CVE: how exactly does an attacker trigger this without either having
*already* completed a DoS attack (consuming all memory) or achieved
arbitrary code execution (altering the allocator to return NULL even though
memory is available)?
In short, this is a crash bug, but not a security issue. This is different
from (for example) a parser bug that results in NULL being dereferenced if
crafted input is processed.
Note that according to the C standard, dereferencing a null pointer
is undefined behavior, not necessarily a crash. This means that
due to compiler optimizations, unexpected code might be run with
uncontrollable behavior. And it may be difficult to prove that the
code is actually safe despite the optimizations.
The issue reported here is a write to address zero causing SIGSEGV. I
doubt that compilers can optimize placement new to avoid writing through
the given pointer without introducing undefined behavior in correct
programs, since the contents of allocated-but-not-initialized memory are
undefined.
-- Jacob
