Re: MSRPC vulnerability 1 billion and six?

[Alexander Sotirov <asotirov () determina com>]

Dave Aitel wrote:
> Hmm. I guess one possible fix would be
> [size_is(size)] [out] * IDL's parsed to be a maximum of "freememory/2".

This wouldn't help much, becase the memory is zeroed with rep stosd after it is
allocated. Not only does this consume 100% CPU for a while, it also commits
every allocated page and might force other programs to get swapped out.

Alex