You know the edict against rolling your own crypto? It needs to be expanded to rolling your own collections in c/c++.
Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
21–30 of 56 posts
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#22this is the second AV fiasco in recent months. is it safe to say that running an antivirus is actually increasing your risk instead of decreasing it?
Erm, it seems you haven't been paying attention. This is the second AV fiasco in the last two days.
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#23You know the edict against rolling your own crypto? It needs to be expanded to rolling your own collections in c/c++.
This is nowhere near the complexity and subtlety of crypto. Inserting into a sorted array is an elementary, computer-science-101 level task and I'd consider it to be not substantially more difficult than writing a correct FizzBuzz.
Then again, if you consider the number who fail at the latter, and how many would want to work on AV software anyway, it's no surprise things like this will happen.
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#24Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#25Couldn't they have avoided it by writing a type-safe parser in Rust?
avast is much older than Rust. The earliest presence on the web that I could find is from 1999 https://web.archive.org/web/19990203125025/http://www.avast....
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#26This is probably a dumb question: but how does someone look at the source code for a commercial product like Avast? Some sort of DLL decompiler or something? If that is the case are things like function and variable names conserved? This is probably super trivial, but reverse engineering / pen testing isn't my area.
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#27Couldn't they have avoided it by writing a type-safe parser in Rust?
It could prevent a part of the problem, depending on how Avast chooses to parse things.
Remote execution would be harder to achieve.
But, parsing anything that you end up evaluating includes a whole class of bugs that Rust can't reason about.
A common (terrible) example on Windows is to serialize a data structure, and then pass it to another program after forking to a new process. If that serialized data includes particular sequences, it can cause the forking process to do other things.
Rust can help you ensure memory safety, and type safety. But it doesn't prevent stupidity.
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#28This is probably a dumb question: but how does someone look at the source code for a commercial product like Avast? Some sort of DLL decompiler or something? If that is the case are things like function and variable names conserved? This is probably super trivial, but reverse engineering / pen testing isn't my area.
In general you just disassemble, decompile, and then name things as you explore them and figure out what they do. Unless there are symbols available (which is rarely the case), the disassembler/decompiler will name things uniquely but not descriptively, e.g. func_117A508D or var_061B.
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#29Earlier quoted context omitted.
Don't make novelty accounts. It is against the rules...
There are no rules written about novelty accounts in either the guidelines or the FAQ. I'm not a fan either and they're just downvoted anyway. But what rule are you referring to?
One of the moderators said that once. So maybe I should have looked it up myself first.