The code library

Juliet · A loader call is identical in both paths. Which data provenance changes its meaning?

NIST SARD / NSA CAS · CC0-1.0 · training fixture

        hModule = LoadLibraryA(data);
        if (hModule != NULL)
        {
            FreeLibrary(hModule);
            printLine("Library loaded and freed successfully");
        }

Revision: SARD 61940 / 1.0.0. Lines 121–126. Exact source · License

The same loader. A different authority.

Dirty Pipe · How can draining a pipe leave behind authority in a recycled descriptor?

Max Kellermann · CM4all / IONOS · GPL-2.0-only · public proof of concept

		unsigned n = r > sizeof(buffer) ? sizeof(buffer) : r;
		read(p[0], buffer, n);
		r -= n;

Revision: Original disclosure / 2022-03-07. Lines 63–65. Exact source · License

The flag that outlived the data.

XZ backdoor · Why does a path-conversion macro swap four byte values before data becomes shell input?

XZ release artifact · Debian archive · FSFULLR · attack artifact

  gl_path_map='tr "\t \-_" " \t_\-"'
changequote(,)dnl
  gl_sed_escape_for_make_1="s,\\([ \"&'();<>\\\\\`|]\\),\\\\\\1,g"

Revision: 46cb28adbbfb8f50a10704c1b86f107d077878e6. Lines 95–97. Exact source · License

When test data became a build step.

PyRIT · How should an AI security evaluation preserve an undetermined result?

Microsoft · PyRIT · MIT · hardening

    if left is False or right is False:
        return False
    if left is None or right is None:
        return None
    return True

Revision: de2f04a637ea96eb8d84260bb40db026ab175bb4. Lines 41–45. Exact source · License

When a security verdict needs a third value.

OpenSSH · What information does an early-returning comparison reveal?

OpenSSH / OpenBSD · ISC · hardening

	for (; n > 0; n--)
		ret |= *p1++ ^ *p2++;
	return (ret != 0);

Revision: aa18063baf35e303832d9ec58204ffaab221de85. Lines 29–31. Exact source · License

OpenSSH’s three-line equality loop and the limits of timing safety

Ghidra · When do two equal numeric offsets describe different machine locations?

NSA · Ghidra · Apache-2.0 · hardening

inline bool Address::operator==(const Address &op2) const { 
  return ((base==op2.base)&&(offset==op2.offset));
}

Revision: bb33bad1960a69cf144653d31676a89367d7c608. Lines 394–396. Exact source · License

Linux · Why must this bounds-hardening helper hide a value from the compiler?

Linux kernel · GPL-2.0-only · hardening

	OPTIMIZER_HIDE_VAR(index);
	return ~(long)(index | (size - 1UL - index)) >> (BITS_PER_LONG - 1);
}

Revision: 74e19ef0ff8061ef55957c3abd71614ef0f42f47. Lines 36–38. Exact source · License

Why Linux hides a number from its compiler.