Re: FAX a virus



Hi,

I don't think not freeing memory will cause any problem. When your
program terminates, the OS will do the cleanup job automatically and
all the memory used by the program will be freed. Its FUD nothing
else.

Regards,

On 3/3/07, Craig Wright <cwright@xxxxxxxxxxxxx> wrote:

Hello,

Attached is a small piece of code designed to write memory without freeing that memory - a situation that will eventually cause a memory overrun and crash as I am not freeing the buffer.

int main(int argc, char **argv)

{ char * MemorytLeak = new char[32];

MemorytLeak [0] = 'B';

printf("%cn", MemorytLeak [0]);

}

You have recieved this as an email. It may be in text form or processed. I can however state that not a single person receiving this e-mail will resultantly have a system crash due to receiving this code. If I was to write it into a script and send the e-mail as HTML, I could still say the same.

Writing text in itself is not an attack. To make this into an attack, I have to do more than just sending it. Stating that it is possible to inject script is not a function of a fax or an OCR engine. I could categorically compile or otherwise run all code and script received a fax machine. I could meticulously ensure that no errors occurred and that the code was correct load it into some application that will run it and state that I have been attacked.

This however is not an attack through fax or OCR for that matter. In the above-mentioned situation the attack occurs not because I have received code, but rather as I have decided to run code or script on my system.

Regards,

Craig

PS

I reiterate, F.U.D.



--
(This e-mail was composed and sent completely using recycled electrons)

Shreyas Zare
Co-Founder, Technitium
eMail: shreyas@xxxxxxxxxxxxxx

..::< The Technitium Team >::..
Visit us at www.technitium.com
Contact us at theteam@xxxxxxxxxxxxxx

Technitium Personal Computers
We belive in quality.
Visit http://pc.technitium.com for details.

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------



Relevant Pages

  • Re: *** glibc detected *** ./a.out: double free or corruption
    ... Sometimes i have problems when freeing the memory of certain ... NULL invokes undefined behavior. ... returned from malloc and again when it is received by removeFPage. ...
    (comp.lang.c)
  • Re: Windows8
    ... That requires knowing in advance how large the string may grow. ... PAD won't do. ... program is ended by the user before freeing. ... the original's memory, which is an entirely safe thing to do. ...
    (comp.lang.forth)
  • Error freeing bug made me think "whats the point?"
    ... I'm returning to programming for UNIX/Linux in C after a break of 15 years and I was never a guru in the first place. ... This afternoon I ran into an error freeing bug in my code which took me 20 mins to debug. ... Pointer1 is assigned to point to the same thing as Pointer2. ... My software calls a function called freeMemory() which uses freeto free the memory of various global variables, ...
    (comp.unix.programmer)
  • Re: Error freeing bug made me think "whats the point?"
    ... This afternoon I ran into an error freeing bug in my code which took me ... Pointer2 is not assigned to NULL. ... free the memory of various global variables, ... the floor and let process termination sweep it up. ...
    (comp.unix.programmer)
  • Re: FAX a virus
    ... I don't think not freeing memory will cause any problem. ... Attached is a small piece of code designed to write memory without freeing that memory - a situation that will eventually cause a memory overrun and crash as I am not freeing the buffer. ... In the above-mentioned situation the attack occurs not because I have received code, but rather as I have decided to run code or script on my system. ...
    (Security-Basics)