[GitHub] [cordova-plugin-file] erisu commented on pull request #434: Update CDVAssetLibraryFilesystem.m

[GitBox <gi...@apache.org>]

erisu commented on pull request #434:
URL: https://github.com/apache/cordova-plugin-file/pull/434#issuecomment-722216528


   Can you provide me the source of your information where it says that malloc will lead to a heap overflow attack and that calloc should be used instead to prevent this?
   
   As far as I understand, both malloc and calloc can have a heap overflow attack if not used properly. It does not matter which one is used.
   
   One of the main differences between malloc and calloc is that calloc will initialize the allocated memory to zero.
   
   Using one over the other I believe is more an opinion I feel, or based on the type of use case. For example, if we do not need to read memory before writing, malloc is OK to use because it is expected to initialize it before reading.
   
   I am trying to understand why you are saying that the original implementation (malloc) will have a heap overflow attack and that your single change to calloc will solve it.
   
   Another source had also pointed out that:
   > calloc is automatically emptied after allocation, which is fatal for the exploitation of certain information disclosure vulnerabilities.
   
   Which does not sound any better.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org