1
$\begingroup$

In the second notes of MIT's Computer Systems Security class (6.858), there is this particular (slightly modified) snippet.

char *p = malloc(44);
char *q = p + 60;
char *r = q + 16;
// r is now at an offset of 60+16=76 from
// p. This means that r is (76-64)=12 bytes
// beyond the end of p. This is more than
// half a slot away, so baggy bounds will
// raise an error.

I understand that Baggy Bounds Checking allows for cheaply checking whether or not a pointer to some allocated memory is within the bounds of that memory. This prevents many forms of attacks that involves overwriting arbitrary portions of the memory. What I fail to understand is this part of the snippet above.

This is more than half a slot away, so baggy bounds will raise an error.

Why should an error be raised whenever accessing memory more than half the slot size from the end boundary of some allocated memory?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.