The many book examples would be exploitable under the traditional attack vectors nowadays in practice, or would generate tons of red lights when put under a static analyser, yet that is how many still program in C.
Bare bones strcpy() and memcpy(), pointer arithmetic all over the place without helper functions to validate application invariants, #ifdef spaghetti code, not using translation units as poor man's modules,...
Comments
I'm not sure I understand what you mean. Can you give a concrete example?
The many book examples would be exploitable under the traditional attack vectors nowadays in practice, or would generate tons of red lights when put under a static analyser, yet that is how many still program in C.
Bare bones strcpy() and memcpy(), pointer arithmetic all over the place without helper functions to validate application invariants, #ifdef spaghetti code, not using translation units as poor man's modules,...