RC RANDOM CHAOS

memory safety

17 posts

Heartbleed was a C bug, not a web bug
Article

Heartbleed was a C bug, not a web bug

CVE-2014-0160 was an out-of-bounds read in OpenSSL C, not a JavaScript flaw. The real mechanism, the network-only telemetry gap, and what survived the patch.

 1992 hardware, no MMU, every payload lands
Article

1992 hardware, no MMU, every payload lands

The Game Boy Work Boy exposes a system with no MMU, DEP, or ASLR - flat executable memory and a fixed layout where any write becomes code execution.

 A renamed file walks past the heap boundary
Article

A renamed file walks past the heap boundary

CVE-2026-48095 is a 7-Zip NTFS heap overflow triggered through renamed files. Operator breakdown of what failed, why, and what must now be true.

 How GCC 4.3 deleted a NULL check in 2009
Article

How GCC 4.3 deleted a NULL check in 2009

How undefined behavior in C lets compilers delete safety checks, why it drives most memory-safety CVEs, and what it means for AI-generated code.

 NGINX rewrite module bleeds memory
Article

NGINX rewrite module bleeds memory

CVE-2026-42945 places a heap buffer overflow inside NGINX's rewrite module, on the request path. Defect class confirmed. Impact not confirmed.