memcpy() with unitialised memory

[CBFalconer]

.... snip ...

[1] For those who weren't around a few years back: The DeathStation
9000 is a hypothetical machine that accepts and does The Right
Thing with conforming and portable C code, but fails in creative
and spectacular ways constrained only by the laws of physics when
given code that is incorrect in any way.

I always thought it was unconstrained when handling incorrect
code. However, real implementations may need that restriction.

 

[Harald van Dijk]

[...] but after I posted it I started wondering
whether there might be occasions where copying unitialised memory
might be useful.

OpenSSL uses this in order to make the random seed a little bit more
random.

If they are doing this to their version of the C rand() (and srand) then
they are not meeting the C standard. [...]

OpenSSL does not implement the standard C library functions. None of the
functions it defines have anything to do with the C standard, nor are
their effects modelled after standard functions.

 

[Lew Pitcher]

... snip ...

[1] For those who weren't around a few years back: The DeathStation
9000 is a hypothetical machine that accepts and does The Right
Thing with conforming and portable C code, but fails in creative
and spectacular ways constrained only by the laws of physics when
given code that is incorrect in any way.

I always thought it was unconstrained when handling incorrect
code.

Hence the ability of the DS9000 to invoke nasal daemons when compiling or
executing code with UB ;-)

However, real implementations may need that restriction.

--
Lew Pitcher

Master Codewright & JOAT-in-training | Registered Linux User #112576
http://pitcher.digitalfreehold.ca/ | GPG public key available by request
---------- Slackware - Because I know what I'm doing. ------

 

[Kaz Kylheku]

[1] For those who weren't around a few years back: The DeathStation
9000 is a hypothetical machine that accepts and does The Right

Speaking of which, the ``DeathStation'' part of the name was in fact inspired
by the similar sounding DECStation, as some may have suspected.

http://en.wikipedia.org/wiki/DECstation

I've never used one and I don't think there was ever a 9000 model (though there
apparently was a VAX 9000).

The 9000 in fact comes from the Banana Jr. 9000, from the ``Bloom County''
comic strip.

http://toastytech.com/guis/banana.html

http://en.wikipedia.org/wiki/Bloom_County

Cheers ...

 

[Spiros Bousbouras]

[1] For those who weren't around a few years back: The DeathStation
9000 is a hypothetical machine that accepts and does The Right

Speaking of which, the ``DeathStation'' part of the name was in fact inspired
by the similar sounding DECStation, as some may have suspected.

http://en.wikipedia.org/wiki/DECstation

Wikipedia used to have a Deathstation 9000 article
but it was deleted due to lack of notability !
Disgraceful.

< http://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletion/DeathStation_9000

 

[Keith Thompson]

[1] For those who weren't around a few years back: The DeathStation
9000 is a hypothetical machine that accepts and does The Right

Speaking of which, the ``DeathStation'' part of the name was in fact inspired
by the similar sounding DECStation, as some may have suspected.

http://en.wikipedia.org/wiki/DECstation

I've never used one and I don't think there was ever a 9000 model
(though there apparently was a VAX 9000).

The 9000 in fact comes from the Banana Jr. 9000, from the ``Bloom County''
comic strip.

Which undoubtedly got it from the HAL 9000. My strong suspicion is
that the DeathStation derived 9000 directly from HAL, and not via the
Banana Jr.

 

[Richard]

Spiros Bousbouras wrote:

[...] but after I posted it I started wondering
whether there might be occasions where copying unitialised memory
might be useful.

OpenSSL uses this in order to make the random seed a little bit more
random.

If they are doing this to their version of the C rand() (and srand) then
they are not meeting the C standard. [...]

OpenSSL does not implement the standard C library functions. None of the
functions it defines have anything to do with the C standard, nor are
their effects modelled after standard functions.

Can anyone tell me the last time Falconer posted something even remotely
correct?

 

[Kenny McCormack]

Can anyone tell me the last time Falconer posted something even remotely
correct?

Well, I'm inclined to give him the benefit of the doubt when he tells us
about his dirty underwear.

 

[Mark Wooding]

It's kind of silly to try to use that as a source of entropy in the
first place. malloc() is often implemented in such a way that
unallocated memory (might) contain information used for memory
allocation within the program's heap (which makes the data there much
more predictable).

Doesn't matter. They're not /relying/ on the uninitialized data being
unpredictable, but if it is, then mixing it into the random-generator's
state makes an attacker's life harder. The only reason this might not
be the case is if the contents of the uninitialized memory is correlated
with stuff we /were/ relying on being unpredictable -- so that the two
cancel out, at least partially.

Whether this is actually possible and exploitable in any given program
is something which might be worth investigating; but I'd speculate that
it's unlikely.

-- [mdw]