Closed Bug 544253 Opened 14 years ago Closed 14 years ago

String::createDynamic has a memory overwrite

Categories

(Tamarin Graveyard :: Virtual Machine, defect)

Product:
Tamarin Graveyard
Component:
Virtual Machine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
VERIFIED INVALID

People

(Reporter: treilly, Unassigned)

Details

Just in debug builds, so don't get excited. It writes 0 to buffer[len] but only allocated len.   The new debug page allocator crashes on this write, its a beautiful thing!
False alarm this code uses GC::Size to check that the overwrite is safe, that it was crashing in the page guard allocator was a bug in the page guard allocator.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → INVALID
bulk verifying resolved !fixed issues
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.