I don't think you understand what a NULL pointer dereference is. It is referencing NULL. NULL as in 0x00. Not 0x00+some_reg, that would now be something greater than 0 and hence IT IS NOT DEREFERENCING NULL.. AKA NOT A NULL DEREFERENCE.<br>
<br>His point remains valid, how is a free(NULL) exploitable for code execution from userland? How does it constitute a security vulnerability?<br><br><br>-- snip --<br><br><br><pre>><i> I'm didn't even comment on Mark's paper, it is definitely a great piece of<br>
</i>><i> research, there is no doubt. It's just that some people have read this paper<br></i>><i> and thought, wow, all those NULL bugs are now exploitable. It's important to<br></i>><i> separate these bug classes.<br>
</i><br>sorry to interrupt your self-aggrandizing tirade, however you're the only<br>one who took the implication that *all* null ptr related bugs are<br>exploitable-- i never implied or said that, just said in some instances<br>
they can be. Furthermore, I think you're taking the word 'dereference' a<br>little too serious and you should perhaps take up a hobby such as baseball<br>cards or miniature collectibles to quench you're apparent need to<br>
sub-categorize into nothing. If you want to insist that null+x/etc bugs be<br>in an entirely separate category than dereferences, that's cool, just don't<br>go all ape-shit on people who dont share your same narrow view at<br>
some feeble attempt at elitism via syntactic pedantry.<br><br></pre><br>