Vulnerability Development mailing list archives

Re: reverse engineer c or java


From: yinyang () EBURG COM (Gordon Messmer)
Date: Sun, 21 May 2000 10:29:19 -0700


Bluefish wrote:
Btw, on the topic of java! Has there been published any research upon
buffert overruns in java? I assume the class String is more or less
secure, but are there security concerns related to usage of e.g. arrays?

I beleive the VM handles this.  Java does not have malloc() and friends
available, and all arrays are static (that is, they can't be dynamically
resized).  Any attempt to access beyond the boundaries of an array do
not crash the application, they "throw an exception".  You aren't going
to write anything to the stack, or alter the memory space of anything
but the array.

It's kind of a nice feature  :)

MSG


Current thread: