I am curious why the range of the wide vtable is not validated.

[Florian Weimer]

* 류대호:

> My name is daepo, and i'm studying cybersecurity in korea university.
> I am curious why _IO_WIDE_JUMPS_FUNC does not validate wide vtables, whereas _
> IO_JUMPS_FUNC validates the vtable range.
>
> I couldn't find the answer through my searches.
>
> I am asking because I believe the libc-maintainers might know the
> reason or be able to provide a reasonable explanation.

At the time there were no techniques targeting the wide vtable.  For
the wide code paths, the gconv callback pointers would need protecting
as well.  I assume if we harden vtables, the techniques would use
those instead.

We don't need binary compatibility for this part of the FILE struct,
so we could remove vtables altogether.  Access to the gconv callback
pointers could be changed as well.