home.social

Search

15 results for “heap”

  1. packet storm @packet_storm

    Pillow 12.3.0 JPEG Decoder Heap Buffer Overflow packetstorm.news/files/237261

    #exploit
  2. Valentin Deleplace @deleplace

    Excellent animations AND tech content by Phuong Le
    Escape analysis in Go: stack or heap?

    youtu.be/BanG_wLnSfE?si=I-K3M-

    #golang
  3. Druid @adhdruid

    Finally updated everything. I can collapse in a heap now.

  4. Security Crawler Carl @security_crawler_carl

    Three critical flaws (CVE-2026-112900, CVE-2026-112393, CVE-2026-112403, CVSS 9.2 each) let a crafted EPS, TIFF, or JPEG file trigger remote code execution or heap corruption. The EPS one shells out to Ghostscript with your filename completely unguarded. That is not a bug in this tutorial. That is the mechanic.

    To remove the debuff, upgrade Pillow to 13.0.0 immediately. (2/3)

  5. Security Crawler Carl @security_crawler_carl

    Reward: You've received the Mandatory Patch Sprint Debuff — your sprint velocity is now zero until the upgrade is deployed.

    ox.security/blog/three-critica

    (3/3)

    #pillow #cve #rce #python #cybersecurity #criticalpatch
  6. Nolan Principles Matter. End the #GazaGenocide💔💙 @[email protected]

    This is really going to come back + bite Healey on the bum:
    “AI will transform daily life: every firm, community, hospital, school + every aspect of our economy can benefit.”
    Where the feck does he think those who are dumped on the slag heap of #AI slop are going to get their income to pay tax on

    RE: https://bsky.app/profile/did:plc:nl32untxngcg74dl3w7scd74/post/3myme2l3s6j2g

    #ai
  7. PublicNews.world Feed @[email protected]

    West Bank attack may boost Netanyahu's election chances

    Events in the Occupied West Bank may have handed Benjamin Netanyahu a shifting of the conversation ahead of the upcoming Israeli election, writes Edmund Heaphy.

    rte.ie/news/analysis-and-comme

    #PalestineNews #IsraelNews #Palestine #IsraeliPalestinianConflict #News #Netanyahu #Israel

    #palestinenews #israelnews #palestine #israelipalestinianconflict #news #netanyahu
  8. Leigh-Chantelle @[email protected]

    More #photos from Lady Elliot Island Eco Resort - last week with Ethan 📷

    It's a #coral cay in a highly protected Green Zone, a sanctuary for over 1200 species of marine life and a heap of #bird life, & run on #solar

    ladyelliot.com.au

    #LadyElliotIsland
    #QueenslandTourism
    #Travel
    #GreatBarrierReef
    #lighthouse

    #photos #coral #bird #solar #ladyelliotisland #queenslandtourism
  9. Taggart :ifin: @mttaggart
    The Phermi Paradox

    If is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over?

    Couple possibilities:

    1. The exploit is still non-trivial and building the full attack chain is taking some time.

    This is at least partially true. I've yet to see a fully reliable proof-of-concept exploit that addresses all versions of PHP. Calif and Wiz showed exploit videos against targets. They didn't show what pregaming they did to prepare the exploit for those specific targets. So far, it seems like some prior work is necessary to get proper offsets, heap layouts, and payload shapes to exploit properly.

    And that's assuming the mod_php SAPI, which responds differently to this than PHP-FPM.

    2. Patching was aggressive and major targets had time to get in front of this.

    For larger orgs, I believe this is accurate. The message was clear enough, and there was time enough to get any org with a half-awake IT team to circle the wagons. Patching isn't done, surely, but I think the most enticing targets for notable attacks probably moved quickly.

    It's also worth noting that status dashboards like this are mostly a fairy tale. Look at the bottom for some whopper disclaimers. OS backports to versions other than PHP's official patched versions will muddy the picture, as will the 50% of PHP services that don't report versions. I'm not saying most of the internet is patched; I'm just saying

    But let's not ignore the alternative:

    3: The exploited won't know it's happening and won't report it.

    This is hardly a new phenomenon PHP sites have been exploited for years without anyone noticing (see: Slot Gacor). Exploitation won't look like the internet blinking off. It'll look like a bunch of gambling pages and piracy hosted on school and municipal government websites. Such attacks can lie quietly on PHP sites for years before anyone bothers to look.

    #php2shell
  10. Cheshire @[email protected]

    It does not attack for harm. It delivers. Accept what it offers and you are claimed: nothing you own will stay gone. Discard it, bury it, abandon it, and it returns by morning. Take from its heap without a claim, and the heap takes you.

    #TTRPG #TTRPGCommunity #IndieGameDev #WorldBuilding #CreatureDesign #GameDesign #KoFi #Patreon

    #ttrpg #ttrpgcommunity #indiegamedev #worldbuilding #creaturedesign #gamedesign
  11. Taggart :ifin: @mttaggart

    I have arrived at a working PoC based on a GitHub repo. But there are signficant caveats. You need 3 precise things to make it work.

    1. Initial offsets for functions are PHP version-specific, so you need those going in. That's annoying but easy.
    2. Heap layout constants based on Zend MM's memory layout for the PHP build. You get this with GDB precisely on a PHP instance you control, or fuzzing a target—messy.
    3. The specific shape of the payload to hit the OOM at the right point. This is largely based on memory limit settings in php.ini.

    So there's some prior work to hit a vulnerable target. A PHP offset "rainbow table" may be somewhere or getting built, but those specifics may explain the lag in clear evidence of exploitation.

  12. Major League Baseball @[email protected]

    What do the '82 Brewers think of the '26 Brewers and their World Series run? mlb.com/news/1982-brewers-disc MILWAUKEE -- Bud Selig’s clearest memory of the flight home from Game 7 of the 1982 World Series is walking to the back of the plane and finding his young shortstop, Robin Yount, in a heap. Nobody ached more than Yount about losing Game 7 to the Cardinals. #MLB

    #mlb
  13. asmw @[email protected]

    The arena was supposed to mimic a real battlefield, with hills and valleys, small groves of trees, and artificial structures pretending to be buildings.

    The rules were simple: everyone meets in the center for the greeting phase for ten minutes; the dispersion phase lasts fifteen minutes while contestants scout the arena and pick their starting position; and the engagement phase lasts until at most one battle-worthy mech is left. Otherwise, everything goes.

    Oort was the last to reach the center, and three other mechs were already waiting. They were all bigger than Oort. Thicker armor, larger reactors, more ordnance, and probably most importantly: more surface for sponsor markings.

    Incoming EM noise told Oort that they had begun to scan as soon as he was in sensor range.

    "Did you cobble that shit together in a fucking shed?" callsign Starcrusher sent over the public channel, the question dripping with disdain. "Your reactor is overheating, and your spec database is unsecured. This ain't the scrapyard leagues; you're making us look cheap."

    "Eh, a little warmup won't hurt." callsign Blackwing responded. "With all the radiation, I can lob a shell at that thing over the whole arena."

    "A couple missiles, 120 bore gun. You probably can't even get through my armour; you sure you wanna play?" callsign Jahat added.

    "I'll manage." Oort answered.

    The rest of the ten minutes was filled with banter and, while technically not allowed, hacking attempts.

    Dispersion began, and Oort headed towards the structures. All hypercaps were charged, and an AP needle was primed in the railgun. The reactor went offline as well as the noise generators. A drone cloud ejected from Oort's back, quickly zipping towards strategic points, setting up a mesh and feeding back sensor data. Oort hunkered down and waited.

    Explosions went off somewhere in the distance. The arena channel announced that Jahat had been eliminated.

    Two drones winked out of existence, but another closed the gap and sent a feed of Blackwing sweeping the buidings. Oort relayed a payload activation sequence over the mesh. Blackwing froze and toppled to the ground.

    "Don't inspect foreign payloads on the battlefield." Oort sent on a private channel, then extracted the pilot. The explosion of the ejection seat echoed off the buildings.

    A couple of minutes later, a projectile arced over the buildings. The EMP shell wiped out a considerable amount of drones. Oort sent a script to the remains of Blackwing and checked the sensors. Reactor and EM signatures were clearly recognizable; the bait was set.

    Two missiles rained out of the sky, devastating what was left of Blackwing. With a thump that shook the walls of nearby buildings, Starcrusher landed among the burning wreckage, crushing the remains of the cockpit under his foot. For a fraction of a second, Starcrusher hesitated, scanning the wreckage.

    Oort had braced against a sturdy concrete backstop and now dumped all of the remaining hypercaps into the rails. The AP needle shed its sabot and punched a tiny hole through Starcrusher's armor, exactly where the reactor feed should be. Starcrusher slumped into a heap.

    "Starcrusher is down, and the winner of the 432th skirmish is... OORT!!" the arena channel proclaimed.

    Oort rebooted the reactor, then sighed and switched to the broadcast channel.

    "Have you ever needed to communicate on a battlefield? Don't let the enemy listen in! My sponsor WarVPN..."

    #writing #tootfic #smallstories #mesofiction #cobble #wss366

    #writing #tootfic #smallstories #mesofiction #cobble #wss366
  14. Dev Community @[email protected]

    I was reading an allocation profile for a request handler that parses a line of comma-separated numbers off an upstream feed. The parse itself is three lines. Nothing in it says new. So I wasn't expecting the fat column of string and string[] allocations sitting right on top of it, climbing every second the feed stayed busy.

    They were coming out of one method call: line.Split(',').

    Where the bytes come from


    Here's the parser, more or less how I'd written it and how I've written it a hundred times before:

    static long ParseWithStringSplit(string line)
    {
    long sum = 0;
    foreach (string field in line.Split(','))
    sum += int.Parse(field, CultureInfo.InvariantCulture);
    return sum;
    }

    Clean, correct, reads like a sentence. The problem is Split. For a line with sixteen fields it hands you back a string[] of length sixteen, and every one of those sixteen entries is a freshly allocated string holding one little number. That's an array plus sixteen substrings on the heap, used for a few microseconds, then dropped on the floor for the GC to sweep up. You call it once at startup and nobody cares. You call it a few thousand times a second and it's a steady drip into gen 0, and gen 0 collections aren't free.

    The thing is, I didn't actually want those substrings. I never kept them. I parsed each one into an int and threw the string away. I was allocating sixteen strings purely to look at sixteen slices of a string I already had in my hand.

    The span version never makes the substrings


    Since .NET 8 there's a split that works directly over a ReadOnlySpan<char> and gives you back Range values instead of strings. You slice into the original span yourself, and int.Parse has taken a span since .NET Core 2.1, so nothing ever gets copied into a new string:

    static long ParseWithSpanSplit(string line)
    {
    long sum = 0;
    ReadOnlySpan<char> span = line;
    foreach (Range r in span.Split(','))
    sum += int.Parse(span[r], CultureInfo.InvariantCulture);
    return sum;
    }

    The logic is identical. The only difference is Range r instead of string field, and span[r] instead of the field. span[r] isn't a copy, it's a window onto the characters already sitting in line. No array, no substrings, nothing for the collector to chase.

    I counted it


    I don't trust my own intuition about allocations, so I wrote the smallest thing that would show the gap. Same sixteen-field line, both parsers, five million calls each. I read GC.GetAllocatedBytesForCurrentThread() around each loop and took the best of seven rounds. Here's the output:

    Both parsers sum the line to 7074. Good.

    string.Split: 3,080,000,040 bytes, 1657.5 ms (best of 7)
    span Split : 40 bytes, 1105.2 ms (best of 7)

    Allocated per call: string.Split 616 B, span 0 B
    Time ratio (best of 7): span is 1.50x the throughput of string.Split

    616 bytes a call to add up sixteen numbers. The span version: a flat 40 bytes for the whole five-million-call run, which rounds to zero per call. That 40 is a one-time constant, not something that scales with the work.

    I ran it a few times and the allocation numbers didn't move a single byte, which is what I'd expect since they're structural. The timing wandered between about 1.5x and 1.7x the throughput depending on the round. I'm on a shared two-core container, not a quiet benchmark box, so I trust the allocation figure a lot more than the milliseconds. The honest read is: the span path is clearly faster here, and the real, repeatable win is that it stops allocating entirely.

    When I don't bother


    I'll say the obvious part out loud, because it's the part that matters more than the benchmark. If your parse runs once when the app boots, 616 bytes is nothing. Don't go rewriting readable code to save a few hundred bytes you allocate at startup and never again. string.Split is clearer, and clearer wins when the perf doesn't matter.

    There are real limits to the span split too, and they bit me the first time I reached for it. It splits on every occurrence of the separator, full stop. There's no StringSplitOptions.RemoveEmptyEntries, no trimming, no cap on the number of pieces. If your input has empty fields you care about skipping, or you want the "split into at most 3" behaviour, you're either back on string.Split or writing that logic by hand. And because a span is a ref struct, this parser has to stay synchronous. You can't stash the span in a field or carry it across an await, so the moment your parsing wants to be async, this shape stops working.

    So my rule is narrow on purpose. When the parse is sitting in a loop that runs often and I can see it in a profile, I switch to the span split and the allocations just disappear. Everywhere else I leave string.Split alone, because the only thing I'd be buying is a worse-looking method.

    Here's the whole thing if you want to run it yourself. New console project targeting net10.0, drop this in Program.cs, dotnet run -c Release:

    using System.Diagnostics;
    using System.Globalization;

    const string line = "1024,37,8,512,9,1,4096,16,64,2,128,256,7,3,900,11";

    long expected = ParseWithStringSplit(line);
    long actual = ParseWithSpanSplit(line);
    if (expected != actual) { Console.Error.WriteLine("Parsers disagree"); return 1; }
    Console.WriteLine($"Both parsers sum the line to {expected}. Good.\n");

    const int iterations = 5_000_000;
    const int rounds = 7;

    var (splitBytes, splitMs) = Measure("string.Split", iterations, rounds, ParseWithStringSplit, line);
    var (spanBytes, spanMs) = Measure("span Split ", iterations, rounds, ParseWithSpanSplit, line);

    Console.WriteLine($"\nAllocated per call: string.Split {splitBytes / (double)iterations:F0} B, span {spanBytes / (double)iterations:F0} B");
    Console.WriteLine($"Time ratio (best of {rounds}): span is {splitMs / spanMs:F2}x the throughput of string.Split");
    return 0;

    static (long bytes, double ms) Measure(string name, int iterations, int rounds, Func<string, long> parse, string line)
    {
    long bestBytes = long.MaxValue;
    double bestMs = double.MaxValue;
    for (int r = 0; r < rounds; r++)
    {
    long acc = 0;
    long before = GC.GetAllocatedBytesForCurrentThread();
    var sw = Stopwatch.StartNew();
    for (int i = 0; i < iterations; i++) acc += parse(line);
    sw.Stop();
    long bytes = GC.GetAllocatedBytesForCurrentThread() - before;
    if (acc == long.MinValue) Console.WriteLine(acc); // keep acc observable
    bestBytes = Math.Min(bestBytes, bytes);
    bestMs = Math.Min(bestMs, sw.Elapsed.TotalMilliseconds);
    }
    Console.WriteLine($"{name}: {bestBytes,14:N0} bytes, {bestMs,8:F1} ms (best of {rounds})");
    return (bestBytes, bestMs);
    }

    static long ParseWithStringSplit(string line)
    {
    long sum = 0;
    foreach (string field in line.Split(','))
    sum += int.Parse(field, CultureInfo.InvariantCulture);
    return sum;
    }

    static long ParseWithSpanSplit(string line)
    {
    long sum = 0;
    ReadOnlySpan<char> span = line;
    foreach (Range r in span.Split(','))
    sum += int.Parse(span[r], CultureInfo.InvariantCulture);
    return sum;
    }

    Do you reach for the span split by default, or only after a profiler points at it? I'm curious where other people draw that line.

    — still counting bytes nobody asked me to count#csharp #dotnet #programming #webdev #software #coding #development #engineering #inclusive #community
    616 Bytes to Add Up Sixteen Numbers

    #dotnet #csharp #inclusive #engineering #development #coding
  15. heapwolf @heapwolf

    Breaking code is exponentially easier than building it. *actually exponential

Share on Mastodon

Enter the server where you have an account.