On Wed, Aug 31, 2011 at 05:18:57PM +0200, joerg-cyril.hoe...@t-systems.com 
wrote:
> Bruno Haible was so kind to provide the following test run results:
> 
> glibc          SIGSEGV
> MacOS X 10.5   (null)
> FreeBSD 6.4    (null)
> OpenBSD 4.9    (null)
> AIX 7.1        empty
> HP-UX 11.31    empty
> IRIX 6.5       (null)
> OSF/1 5.1      (null)
> Solaris 10     SIGSEGV
> Cygwin         (null)
> mingw          (null)
> 
> for printf("%s", NULL)

Some of the systems will have address zero valid and just read from
that address. Some will generate a non zero length string.
IIRC some very old OS (think vax and pdp11) arranged for address
zero to contain zero (possibly as part of the program header) so
that 'if (x && *x)' could be shortened to 'if (*x)'.
Allowing address zero be mapped (eg by mmap()) is a bad idea
as a kernel 'call through NULL ptr' can be used to escalate
privs.

        David

-- 
David Laight: da...@l8s.co.uk


Reply via email to