This was my very first thought when I read that it occurred on Android, so I know it had to be someone’s first thought working on this. Very unfortunate, but I’m pretty sure we’ve all been there, with a gut feeling we either ignored or outright doubted that could’ve potentially saved months at minimal risk.
This the main take away. Even when writing C, just prefer safe libraries to default strings and arrays, when possible.
By the way, MSR is hiring for Checked C.
Only internships ATM according to their web page
> We have positions available for a Principal Software Engineer and Senior Software Engineer. We are looking for engineers who have production compiler development experience and who value shipping software.
And even then, many of those interfaces are based in C semantics anyway.
So anything that helps to reduce the amount of possible security exploits per line of C code is welcomed.
> C-style programming in C++ is also a bad sign; the IOBuffer design pattern with separate storage of buffers and their sizes is inherently dangerous.
Rust has "slices", which store a pointer and a length together, so they cannot get out of sync like this.
Do they have a bounty program for HTML where one can submit a fix? /s
This is not a new issue. Been like that for a long time
Try the non-mobile version: https://googleprojectzero.blogspot.com/2020/02/several-month...
It seems to be using the default simple blogger theme so there's probably no point of contact for the website, it's Google after all. The best chance you have is to submit a bug report with Apple about Safari not rendering the page right.
Ps: The down votes on my original rant can stop now, I hope. Thx ;)
