Re^4: Why do poisoned null attacks still work ?

what better way of opening a file do you see than asking the OS to open it?

Noone denies that open(2) will be called. The question is what else needs to be done. If your interface and the system's differ (as they do here), you need to take steps to handle incompatibilities.

Perl could try to wrap all C APIs that are known to take a C string

Try? They're already wrapped. Systems calls don't know anything about scalars and Perl's stack. The problem is in the conversion from scalars to C-strings, and that occurs entirely in Perl.

Besides, "it's hard to catch every instance so we shouldn't fix any instance" is a very lame argument.

Comment on Re^4: Why do poisoned null attacks still work ? Download Code

Replies are listed 'Best First'.
Re^5: Why do poisoned null attacks still work ? by Corion (Patriarch) on Jul 22, 2009 at 21:24 UTC
As (the string parts of) Perl scalars always are terminated with a `\0`, I doubt that there is much conversion happening at the interface between Perl and the C library. But as Taint will catch this and other errors, I don't see why there should be another system.	[reply] [d/l]
Re^6: Why do poisoned null attacks still work ? by ikegami (Patriarch) on Jul 22, 2009 at 22:53 UTC
They're not always. While places that omit the trailing NUL tend to get fixed, it's also considered a bug to expect it to be present from what I've seen.	[reply]
Re^7: Why do poisoned null attacks still work ? by Anonymous Monk on Jul 23, 2009 at 00:45 UTC
How do you mean?	[reply]
Re^8: Why do poisoned null attacks still work ? by ikegami (Patriarch) on Jul 23, 2009 at 03:43 UTC
Re^9: Why do poisoned null attacks still work ? by ysth (Canon) on Jul 26, 2009 at 20:18 UTC