Ryan "UnionToTuple" Cavanaugh on Mythryl: “Combining all the security reports into one mega-report, like…”

Combining all the security reports into one mega-report, like Voltron "What if you ask the OS for a BSTR* and it allocates you one at 0x00000004? Then when you check the length you'll null dereference. This is a denial of service attack"

Ryan "UnionToTuple" Cavanaugh@searyanc.dev

Not sure who needs to hear this but there is not a sensible threat model where you have to defend against the possibility that the operating system lies to you about the size of a block of memory it allocated

2/10/26, 11:49 pm0 reposts13 likes

Post