Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c > #141135 > unrolled thread

7 out of 10 Microsoft Windows patches address memory issues from C/C++ code

Back to article view | Back to comp.lang.c

Contents

  7 out of 10 Microsoft Windows patches address memory issues from C/C++ code "Rick C. Hodgin" <rick.c.hodgin@gmail.com> - 2019-02-18 10:15 -0500
    Re: 7 out of 10 Microsoft Windows patches address memory issues from C/C++ code "Mr. Man-wai Chang" <toylet.toylet@gmail.com> - 2019-02-19 00:28 +0800
    Re: 7 out of 10 Microsoft Windows patches address memory issues from C/C++ code Ben Bacarisse <ben.usenet@bsb.me.uk> - 2019-02-18 18:34 +0000
      Re: 7 out of 10 Microsoft Windows patches address memory issues from C/C++ code "I Set My Girlfriend's Pantyhose on Fire" <cdalten@gmail.com> - 2019-02-21 13:35 -0800

#141135 — 7 out of 10 Microsoft Windows patches address memory issues from C/C++ code

https://www.fudzilla.com/news/pc-hardware/48123-more-than-70-percent-of-microsoft-patches-are-for-memory-problems

     "More than 70 percent of Microsoft patches are for memory safety bugs.

     "Speaking to the assembled throngs at an Israel Security conference,
      a Microsoft engineer Matt Miller said that memory safety bugs happen
      when software, accidentally or intentionally, accesses system memory
      in a way that exceeds its allocated size and memory addresses.

     "He said that over the the last 12 years, around 70 percent of all
      Microsoft patches were fixes for memory safety bugs.

     "The reason for this high percentage is because Windows has been writ-
      ten mostly in C and C++, two 'memory-unsafe' programming languages...

     "One slip-up in the developers' memory management code can lead to a
      slew of memory safety errors that attackers can exploit with dangerous
      and intrusive consequences --such as remote code execution or elevation
      of privilege flaws..."

-- 
Rick C. Hodgin

[toc] | [next] | [standalone]

#141136

On 2/18/2019 11:15 PM, Rick C. Hodgin wrote:
> 
>       "He said that over the the last 12 years, around 70 percent of all
>        Microsoft patches were fixes for memory safety bugs.

It's not the fault of C nor C compilers. It's the programmers 
deliberately not auditing their memory use.

-- 
   @~@   Remain silent! Drink, Blink, Stretch! Live long and prosper!!
  / v \  Simplicity is Beauty!
/( _ )\ May the Force and farces be with you!
   ^ ^   (x86_64 Ubuntu 9.10)  Linux 2.6.39.3
¤£­É¶U! ¤£¶BÄF! ¤£½ä¿ú! ¤£´©¥æ! ¤£¥´¥æ! ¤£¥´§T! ¤£¦Û±þ! ¤£¨D¯«! 
½Ð¦Ò¼{ºî´© (CSSA):
http://www.swd.gov.hk/tc/index/site_pubsvc/page_socsecu/sub_addressesa

[toc] | [prev] | [next] | [standalone]

#141138

"Rick C. Hodgin" <rick.c.hodgin@gmail.com> writes:

> https://www.fudzilla.com/news/pc-hardware/48123-more-than-70-percent-of-microsoft-patches-are-for-memory-problems
>
>     "More than 70 percent of Microsoft patches are for memory safety bugs.
>
>     "Speaking to the assembled throngs at an Israel Security conference,
>      a Microsoft engineer Matt Miller said that memory safety bugs happen
>      when software, accidentally or intentionally, accesses system memory
>      in a way that exceeds its allocated size and memory addresses.
>
>     "He said that over the the last 12 years, around 70 percent of all
>      Microsoft patches were fixes for memory safety bugs.

I wonder if any explanation was offered as to why so many of these bugs
were found by people who probably had no access to the source code
rather than by people doing code reviews and testing.

If these are, in fact, the result of internal review, then the timing
just needs to be altered.

If these are being found internally before release, then it's bug fixing
and not really headline news.

Not that that lets C off the hook, but it does look like an exercise in
looking everywhere but on your own doorstep.  (That's from the limited
quotes -- there's no link to what was actually said.)

-- 
Ben.

[toc] | [prev] | [next] | [standalone]

#141166

I dunno about Microsoft, but at my previous engineering job, I had to battle some dickhead douchebag manager who thought he was God's gift to engineering. As a result, well, I felt that some of our issues could have never arisen if he would have given his ego a rest and actually listened to the people below him.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.c

csiph-web