Redditors cope and seethe when stockfish chads refuse to address esoteric buffer overflow exploit

[Deleted by author.]
27
Jump in the discussion.

No email address required.

I don't get what any of this means :marseyretardchad:

Jump in the discussion.

No email address required.

If Stockfish runs from an illegal position, it can crash from a buffer overflow. This is potentially unsafe, but it would be extremely difficult, and practically impossible to find an illegal position that it would crash in a way that would be exploitable.

If anyone really cares about this they can just validate the input before running stockfish and problem solved.

The stockfish devs don't want to fix it because they only care about legal chess. Patching all the ways it could crash from illegal positions for security reasons would harm performance and bloat the software.

Redditors in /r/programming aren't professional codecels so they only see it as Buffer Overflow -> Insecure Application -> :marseyrave:.

Jump in the discussion.

No email address required.

They can just do those checks inside #ifdefs and add a -oUnsafe option to the compilation where you throw all safety guarantees out the window.

This dude has a point. However, at the end of the day, it's the maintainer's call and their time going into supporting the software. Devs just don't like being politely told to frick off because their over-engineering might not be worth the time or effort.

Edit: The maintainer's responses were also pretty spergtastic.

Jump in the discussion.

No email address required.

Thanks kind stranger, have this reddit gold :marseygold:

Jump in the discussion.

No email address required.

also what is stockfish

Jump in the discussion.

No email address required.

Jump in the discussion.

No email address required.

Don't fix it! It's not remotely exploitable! It's too hard to exploit!

Meanwhile...

Jump in the discussion.

No email address required.

Meanwhile what? Has it been exploited? Has anyone even created a proof of concept for an exploit?

Jump in the discussion.

No email address required.

If a vulnerability has been discussed on a forum it's my opinion that an exploit for that vulnerability exists.

Jump in the discussion.

No email address required.

To quote one of the Redditors going against the hive mind:

Finding this set of positions will take you decades on even the most expensive hardware. For reference, to count the number of ways a real chess game can go from the starting position given a depth of 15, it took 32 GPUs around eight days to do so. Here, the problem is completely random and not uniformly so. This begs even more time. I'm estimating well over a decade, and maybe well over multiple decades. And this is only applicable if such said position even exists (we don't even know if it does).

Having taken some time to read through the GitHub issue thread, I can sympathize with the guy who raised the issue and I think the maintainer was being a bit of an butt in response. However, I think all the people ragging on this issue are significantly overestimating the risk factor of this vulnerability because they want to be smug and sneer at someone who won't entertain their pedantry.

The one issue I saw that I think needs to be addressed is the fact that the software continues running after the overflow occurs. The quickest fix would be to have the software fail loudly if the buffer is exceeded. I cannot imagine simple moveset size check would have a meaningful impact on peformance.

Jump in the discussion.

No email address required.

significantly overestimating the risk factor of this vulnerability

If you think that militaries don't have supercomputers the size of small islands 24/7 cranking out solutions to 'we know a theoretical buffer overflow exists here, find the inputs that cause it' type questions then, well, why do you think that?

That's literally their job. They research new conventional weapons 24/7, why do you think the same doesn't extend to cyber?

Jump in the discussion.

No email address required.

Yes, all those military supercomputers devoting millions of dollars worth of cycles to analyzing illegal moveset inputs for an obscure chess program. This is exactly the kind of pedantry I was talking about.

Jump in the discussion.

No email address required.

Stockfish isn't obscure and the type of people that spend a lot of time playing chess are likely to be people with interesting stuff on their computers.

Agree to disagree it seems we must

Jump in the discussion.

No email address required.

How many running instances of Stockfish are public-facing? Again, I don't think it's a complete non-issue and I think that the maintainer should just insert a conditional to crash the program immediately when the moveset size exceeds 256, but the maintainer's stance is not as unreasonable as Redditors want to believe.

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.