Stories
Slash Boxes
Comments

SoylentNews is people

posted by chromas on Monday April 09 2018, @06:12PM   Printer-friendly
from the (unsigned⠀int) dept.

https://www.theregister.co.uk/2018/04/04/microsoft_windows_defender_rar_bug/

A remote-code execution vulnerability in Windows Defender – a flaw that can be exploited by malicious .rar files to run malware on PCs – has been traced back to an open-source archiving tool Microsoft adopted for its own use.

[...] Apparently, Microsoft forked that version of unrar and incorporated the component into its operating system's antivirus engine. That forked code was then modified so that all signed integer variables were converted to unsigned variables, causing knock-on problems with mathematical comparisons. This in turn left the software vulnerable to memory corruption errors, which can crash the antivirus package or allow malicious code to potentially execute.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by tangomargarine on Tuesday April 10 2018, @09:44PM

    by tangomargarine (667) on Tuesday April 10 2018, @09:44PM (#665112)

    We weren't talking about "easiest." The original term was "most consistent," which ironically we are very lacking in this conversation.

    I would generally agree that Java/Python are easier and more elegant to use. You want C++ for large, complex projects, that you want to be efficient and maintainable || embedded programming. Or at least that's my impression.

    Mostly I'd contrast C++ with Ruby and JavaScript. I really don't like duck typing. Just the ideas of not being able to figure out what sort of data a variable holds from a glance at the code, having no compile-time checking--the only way to tell whether your code works is to run it--make me feel nervous and icky. Stuff like this [destroyallsoftware.com] just bends my principle of least astonishment over a chair and fucks it senseless.

    Personally I think it would even be a better idea to teach students Ada than C++ as their first language (no, stop laughing! :) because it forces you to think in terms of diligent consistency. Programming isn't something you can just wildly chuck at a wall and hope for the best with. And I found my crash course in assembly pretty informative as to explaining why we do fundamental things certain ways in programming.

    Still not sure whether I really like C++. I was doing a year of unit testing in it in 2016, and wrestling with the compiler output was a constant struggle. It would never outright lie but it usually seemed to be doing its best to mislead me as to what the problem was. Forget to initialize a member of a structure and it spits out some cryptic thing about memory alignment difficulties. Once you got into the right line of thinking about it, it usually made some perverse sort of sense, though. And C++ doesn't try to hide the fact that it's using pointers like Java. And you can specify how to pass parameters! Just being able to tell the code exactly what you want it to do is nice sometimes. No "Java is pass by value...except the value is the reference...except for primitives" mindtwisters.

    I'm doing mostly JavaScript now, but prefer Java (CLI) or C# (GUI) for personal projects. Just going to trail off now. I'm 28 so that's my $0.02.

    --
    "Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2