[Gc] security issue with libgc ?

Christophe Meessen meessen at cppm.in2p3.fr
Sat Mar 17 13:22:28 PST 2007


Thank you very much MentalGuy to take the time to answer. Now I start to
get the picture.

gc is keeping tracks of blocks and any byte sequence corresponding to an
address in one of these blocks is counted as a reference to this bloc.
Right ?

I didn't got that in the first place because the intuitive way to do the
mark process is to follow pointers. If libgc doesn't do this, then it is
indeed more robust and the only risk with "raw data injection" is memory
leak.

The risk is limited, I agree, but Murphy's law may be proven true once
again. In my case the program is a network service that has to run for a
very long time, like a web server. So memory leak will grow
exponentially because effects adds up.

I red something about a blacklist of fake pointers in blocks. What is
its purpose ? If we had the possibility to tell what byte sequence in a
block, or on the stack, are pointers, the memory leak risk could be
significantly reduced. In C++ we would only have to define this once per
class.



More information about the Gc mailing list