Null bytes have long been a hacker’s best friend—sneaking past security controls, corrupting logic, and turning safe-looking code into a playground for exploits. But what happens when these elusive troublemakers collide with modern C++?
This talk unravels a common yet dangerous pattern: mixing C-style strings in C++ code. We’ll kick things off with some fascinating quirks of C++ strings before diving deep into real-world vulnerabilities. Through an in-depth walkthrough of multiple CVEs in a widely used C++ package, we’ll expose how the same HTTP Response Splitting flaw was discovered, patched, and then rediscovered—again and again.