How a Memory Bug Becomes a Security Hole for Sleep

How does a small mistake about memory let a stranger's input take control of a program? You will follow one small example program from numbered boxes of memory to buffer overflows and use-after-free, and see what address randomisation, stack canaries and memory-safe languages each change. IN THIS VIDEO A patient introduction for listeners new to the subject. The running example uses invented addresses and values, and the episode explains mechanisms without showing how to build an exploit. The real-world figures come from Chromium and Android, so they describe those two projects and not all software. CHAPTERS 0:00:00 Intro 0:00:03 Memory is one long row of numbered boxes 0:13:53 A pointer is a number used as an address 0:26:25 The stack keeps return addresses beside your data 0:40:15 Writing past a buffer overwrites what comes next 0:55:17 Use-after-free reads a box someone else now owns 1:09:10 Half of Chromium's memory bugs are use-after-free 1:23:45 Address randomisation makes the target harder to find 1:38:54 Stack canaries catch the overwrite before return 1:53:16 Rust's ownership rule rejects the bug at compile time 2:07:30 Android's share fell from 76 to below 20 percent 2:22:13 Preventing bugs in new code compounds over time SOURCES AND RESOURCES Chromium Security, Memory safety: https://www.chromium.org/Home/chromium-security/memory-safety/ Chromium, The Rule of 2: https://chromium.googlesource.com/chromium/src/+/main/docs/security/rule-of-2.md Google Security Blog, Use-after-freedom: MiraclePtr (2022): https://security.googleblog.com/2022/09/use-after-freedom-miracleptr.html Google Security Blog, Memory Safe Languages in Android 13 (2022): https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html Google Security Blog, Eliminating Memory Safety Vulnerabilities at the Source (2024): https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html Google Security Blog, Rust in Android: move fast and fix things (2025): https://security.googleblog.com/2025/11/rust-in-android-move-fast-fix-things.html Alexopoulos et al., How Long Do Vulnerabilities Live in the Code? (USENIX Security 2022): https://www.usenix.org/system/files/sec22-alexopoulos.pdf ISO/IEC 9899:201x, C standard committee draft N1570: https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1570.pdf System V Application Binary Interface, AMD64 supplement: https://gitlab.com/x86-psABIs/x86-64-ABI/-/jobs/artifacts/master/raw/x86-64-ABI/abi.pdf?job=build RFC 20, ASCII format for network interchange: https://www.rfc-editor.org/rfc/rfc20.txt RFC 1135, The Helminthiasis of the Internet: https://www.rfc-editor.org/rfc/rfc1135.txt Aleph One, Smashing the Stack for Fun and Profit (Phrack 49, 1996): https://insecure.org/stf/smashstack.html MITRE CWE-121, CWE-416 and CWE-787: https://cwe.mitre.org/data/definitions/121.html https://cwe.mitre.org/data/definitions/416.html https://cwe.mitre.org/data/definitions/787.html malloc(3), Linux man-pages: https://man7.org/linux/man-pages/man3/malloc.3.html PaX, Address Space Layout Randomization: https://pax.grsecurity.net/docs/aslr.txt Shacham et al., On the Effectiveness of Address-Space Randomization (2004): https://hovav.net/ucsd/dist/asrandom.pdf Linux kernel documentation, randomize_va_space: https://docs.kernel.org/admin-guide/sysctl/kernel.html Cowan et al., StackGuard (USENIX Security 1998): https://www.usenix.org/legacy/publications/library/proceedings/sec98/full_papers/cowan/cowan.pdf GCC documentation, stack protector options: https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html The Rust Programming Language: https://doc.rust-lang.org/book/ch04-01-what-is-ownership.html Rust compiler error index, E0382 and E0505: https://doc.rust-lang.org/error_codes/E0382.html https://doc.rust-lang.org/error_codes/E0505.html