Welcome, Guest. Please login or register.

Author Topic: Security risks using data saves that include pointers ?  (Read 3245 times)

Description:

0 Members and 1 Guest are viewing this topic.

Offline Karlos

  • Sockologist
  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Nov 2002
  • Posts: 16879
  • Country: gb
  • Thanked: 5 times
    • Show all replies
Re: Security risks using data saves that include pointers ?
« on: January 30, 2007, 08:35:27 PM »
There is absolutely no reason to ever save a pointer on any normal system. The value it has is meaningless outside the particular instance the application was run.

The other point is that disk IO is almost always the determining factor in loading / saving files. Therefore there is no real performance gain in dumping a chunk of memory as binary data compared to finding a rational way of formatting the data for storage and doing that.

What I mean is, don't just dump the memory image of a structure, define a function that can serialize that structure to a file and have the equivalent function to unserialize it. More than likely not every field is needed.

If you have a lot of structures that reference each other, you can iterate the collection of structures you are to save, assign id values to each one (making it the first bit of data written for each structure definition) and replace pointers with id values of the objects the point to during serialization.

For completeness, you could even build a structure that contains record pairs of the structure id versus offset into the file and store that too. This gives you a complete map fron which you can totally reconstitute the data on loading, even if the objects all end up at different addresses, they will still correctly point to each other when you turn the id values back into pointers (which you do after loading them all, remembering where you allocated each one).

int p; // A
 

Offline Karlos

  • Sockologist
  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Nov 2002
  • Posts: 16879
  • Country: gb
  • Thanked: 5 times
    • Show all replies
Re: Security risks using data saves that include pointers ?
« Reply #1 on: January 31, 2007, 01:15:16 AM »
I'm sure he is, but dumping the data as opposed to structuring it for saving is surely just laziness.

Of course, if it's just a whole bunch of binary data, who would know which value in there was a pointer in the first place?
int p; // A