What you're probably seeing is what developers are forced to work around: the fact that everyone is stuck targeting ancient versions of Android because Android users have just accepted their devices never getting OS upgrades.Īndroid Studio will still default to targeting a minimum SDK version of API 25. So even design language changes can (and often do) break the UI.

It's a bit of a weirder exploit path but honestly with how ridiculous UAF flows have gotten with modern mitigations on iOS, it's hardly the worst thing I've ever seen and I suspect someone will get decent mileage out of itĪndroid's backwards compatibility is atrocious with a capital A.Įvery version has random will-be-breaking changes that get held off if your app was compiled before said version came out, but there's only a release or two before the change starts to ignore your compiled version (for example, when a massive permissions change comes down the pipe, any app that's compiled against the newest SDK breaks immediately, and apps that were compiled against older ones just get to break next release)Īnd just like any mobile platform, apps heavily rely on the OS to provide UI widgets and layout. Now when a new object is allocated there, we end up using the corrupted data and invoking the evil pointer, and the rest is history. Now, as you mention, if calloc didn't zero, an attacker could scribble over what they think will be the next allocated slot in the heap (either by targeting a partially used page or an entirely unused page that's just being kept in malloc's retainer) and write a value into the callback pointer field. In a single threaded application, you would not be able to target the function pointer here because nothing interesting happens between calloc and the invocation since the if check will always fail due to it being zero'd from calloc. It's contrived for simplicity, but suppose obj had a function pointer in it and just after allocation the object is passed to another routine which does some work on the object and checks if the callback exists and calls it if it does.

Yeah, more or less! This closes some paths and opens brand new ones, like more of the former and less of the latter.

Scribble It! for ios instal free