<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress/2.0.5" -->
<rss version="2.0" 
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
<channel>
	<title>Comments on: Attacking delete and delete [] in C++</title>
	<link>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/</link>
	<description>Continued ramblings on software security and code auditing</description>
	<pubDate>Fri, 30 Jul 2010 13:32:49 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.0.5</generator>

	<item>
		<title>by: sandrar</title>
		<link>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-66629</link>
		<pubDate>Thu, 10 Sep 2009 22:27:57 +0000</pubDate>
		<guid>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-66629</guid>
					<description>Hi! I was surfing and found your blog post... nice! I love your blog.  :) Cheers! Sandra. R.</description>
		<content:encoded><![CDATA[<p>Hi! I was surfing and found your blog post&#8230; nice! I love your blog.  :) Cheers! Sandra. R.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Rodrigo Araujo</title>
		<link>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-63884</link>
		<pubDate>Fri, 24 Apr 2009 13:16:00 +0000</pubDate>
		<guid>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-63884</guid>
					<description>Very enlightening, thanks a lot for all this information.</description>
		<content:encoded><![CDATA[<p>Very enlightening, thanks a lot for all this information.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: baikunta</title>
		<link>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-47659</link>
		<pubDate>Mon, 09 Feb 2009 09:57:00 +0000</pubDate>
		<guid>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-47659</guid>
					<description>HI here Baikunta ,,,

that counter which holds the number of object created from &#8230;..

new or malloc &#8230;

is there any method that we get the address of that counter</description>
		<content:encoded><![CDATA[<p>HI here Baikunta ,,,</p>
<p>that counter which holds the number of object created from &#8230;..</p>
<p>new or malloc &#8230;</p>
<p>is there any method that we get the address of that counter
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: jm</title>
		<link>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-70</link>
		<pubDate>Thu, 11 Jan 2007 18:08:52 +0000</pubDate>
		<guid>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-70</guid>
					<description>Sure, check out libstdc++-v3/libsupc++/vec.cc in the *vec_delete* functions.</description>
		<content:encoded><![CDATA[<p>Sure, check out libstdc++-v3/libsupc++/vec.cc in the *vec_delete* functions.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Alex</title>
		<link>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-68</link>
		<pubDate>Thu, 11 Jan 2007 11:34:49 +0000</pubDate>
		<guid>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-68</guid>
					<description>I checked libsupc++ but didn't find where delete[] is implemented. Could you point to a filename?</description>
		<content:encoded><![CDATA[<p>I checked libsupc++ but didn&#8217;t find where delete[] is implemented. Could you point to a filename?
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: mark</title>
		<link>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-48</link>
		<pubDate>Thu, 04 Jan 2007 03:39:42 +0000</pubDate>
		<guid>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-48</guid>
					<description>There is one pretty important detail we forgot to mention with regards to primitive types that I feel I should mention here. When arrays of primitive types are constructed, there is no count element preceding the objects in the block of memory allocated for the array. The reason for this is probably because no special destruction or construction needs to be done on those types, and so the count is not required. Therefore, using delete on an array of primitive types should work correctly, although I have yet to test it out.</description>
		<content:encoded><![CDATA[<p>There is one pretty important detail we forgot to mention with regards to primitive types that I feel I should mention here. When arrays of primitive types are constructed, there is no count element preceding the objects in the block of memory allocated for the array. The reason for this is probably because no special destruction or construction needs to be done on those types, and so the count is not required. Therefore, using delete on an array of primitive types should work correctly, although I have yet to test it out.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: jm</title>
		<link>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-47</link>
		<pubDate>Wed, 03 Jan 2007 22:48:17 +0000</pubDate>
		<guid>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-47</guid>
					<description>Sorry, our comment system is rubbish. :&gt; When I get a chance, I'll fix your comment and see if I can fix the system. At any rate, thanks for the feedback guys, and STL is definitely on our to-do list.</description>
		<content:encoded><![CDATA[<p>Sorry, our comment system is rubbish. :> When I get a chance, I&#8217;ll fix your comment and see if I can fix the system. At any rate, thanks for the feedback guys, and STL is definitely on our to-do list.
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Ben FrantzDale</title>
		<link>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-46</link>
		<pubDate>Wed, 03 Jan 2007 22:43:23 +0000</pubDate>
		<guid>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-46</guid>
					<description>(The above post got mangled a bit (no preview?). In particular it ate the angle brackets. The std::vector is of type bob, the static_cast is to void*, and the templated function is templated on "typename BasebobIterator".)</description>
		<content:encoded><![CDATA[<p>(The above post got mangled a bit (no preview?). In particular it ate the angle brackets. The std::vector is of type bob, the static_cast is to void*, and the templated function is templated on &#8220;typename BasebobIterator&#8221;.)
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Ben FrantzDale</title>
		<link>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-45</link>
		<pubDate>Wed, 03 Jan 2007 22:36:51 +0000</pubDate>
		<guid>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-45</guid>
					<description>You make a good point, but overall I see this as yet another reason to use STL over C-style arrays. In my C++ code I essentially never call delete[] or delete or new[]; I sometimes call new but then hand the result off to an auto_ptr.  In your example you have:&lt;br /&gt;&lt;br /&gt;
&lt;pre&gt;int main(void)&lt;br /&gt; {&lt;br /&gt;    basebob *ba = (basebob *)   new bob[1024];&lt;br /&gt;    dostuff(ba);&lt;br /&gt;    delete ba;&lt;br /&gt; }&lt;/pre&gt;
The C++ way to write this is:&lt;br /&gt;&lt;br /&gt;
&lt;pre&gt;int main(void)&lt;br /&gt; {&lt;br /&gt;   std::vector &#60;bob&#62; ba(1024);&lt;br /&gt;   dostuff(&#38;ba[0]); // An admitted wart in the std::vector interface, but it does the job.&lt;br /&gt; }&lt;/pre&gt;
In this C++ version, there is no way to mess up destruction. Even if dostuff throws an exception, we won't leak memory.  Of course, a problem with this is that dostuff(basebob* foo) might try to access foo[1], which is located at   static_cast&#60;void *&#62;(foo) + sizeof(basebob) and not at   static_cast&#60;void *&#62;(foo) + sizeof(bob).  If we are allowed to change the signature of dostuff(), it could be even safer. The STL version, of course, would be:&lt;br /&gt;&lt;br /&gt;
&lt;pre&gt;template &#60;typename BasebobIterator&#62;   void dostuff(BasebobIterator first, BasebobIterator last);&lt;/pre&gt;
Then we could call   dostuff(ba.begin(), ba.end()); or if we had a bob* called bobptr, we could still use that by calling   dostuff(bobptr, bobptr + 1024);</description>
		<content:encoded><![CDATA[<p>You make a good point, but overall I see this as yet another reason to use STL over C-style arrays. In my C++ code I essentially never call delete[] or delete or new[]; I sometimes call new but then hand the result off to an auto_ptr.  In your example you have:</p>
<pre>int main(void)
 {
    basebob *ba = (basebob *)   new bob[1024];
    dostuff(ba);
    delete ba;
 }</pre>
<p>The C++ way to write this is:</p>
<pre>int main(void)
 {
   std::vector &lt;bob&gt; ba(1024);
   dostuff(&amp;ba[0]); // An admitted wart in the std::vector interface, but it does the job.
 }</pre>
<p>In this C++ version, there is no way to mess up destruction. Even if dostuff throws an exception, we won&#8217;t leak memory.  Of course, a problem with this is that dostuff(basebob* foo) might try to access foo[1], which is located at   static_cast&lt;void *&gt;(foo) + sizeof(basebob) and not at   static_cast&lt;void *&gt;(foo) + sizeof(bob).  If we are allowed to change the signature of dostuff(), it could be even safer. The STL version, of course, would be:</p>
<pre>template &lt;typename BasebobIterator&gt;   void dostuff(BasebobIterator first, BasebobIterator last);</pre>
<p>Then we could call   dostuff(ba.begin(), ba.end()); or if we had a bob* called bobptr, we could still use that by calling   dostuff(bobptr, bobptr + 1024);
</p>
]]></content:encoded>
				</item>
	<item>
		<title>by: Matt</title>
		<link>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-44</link>
		<pubDate>Wed, 03 Jan 2007 22:20:40 +0000</pubDate>
		<guid>http://taossa.com/index.php/2007/01/03/attacking-delete-and-delete-in-c/#comment-44</guid>
					<description>Very nice post. Discussing it with a C++ guru of my acquaintance, though, raised the question of how often you actually see &lt;code&gt;new[]&lt;/code&gt; in C++ written these days, given the myriad, generally better options afforded by the STL. If the answer is (as he claims) "not much," it's time to start banging on STL implementations, as hinted at by Thomas this morning over on Chargen :)</description>
		<content:encoded><![CDATA[<p>Very nice post. Discussing it with a C++ guru of my acquaintance, though, raised the question of how often you actually see <code>new[]</code> in C++ written these days, given the myriad, generally better options afforded by the STL. If the answer is (as he claims) &#8220;not much,&#8221; it&#8217;s time to start banging on STL implementations, as hinted at by Thomas this morning over on Chargen :)
</p>
]]></content:encoded>
				</item>
</channel>
</rss>

<!-- Dynamic Page Served (once) in 0.077 seconds -->
