> Every time you see a crash which is caused by jumping to some unknown address, there's a pretty good chance that the crash is exploitable
No. It's not 2001. Modern MS (and UNIX) operating systems and compilers use NX, stack guarding, and addr randomization to make stack/heap overflows pretty difficult to exploit. Not impossible, but statistically unlikely. Run-of-the-mill C programming errors in a web browser are hardly automatic remote sploits now.
> every crash caused by user supplied data should be looked at from the "might be exploitable in the future" perspective.
OK, I agree with this, but out of principle, not because there's a high chance it's remotely exploitable.
No. It's not 2001. Modern MS (and UNIX) operating systems and compilers use NX, stack guarding, and addr randomization to make stack/heap overflows pretty difficult to exploit. Not impossible, but statistically unlikely. Run-of-the-mill C programming errors in a web browser are hardly automatic remote sploits now.
> every crash caused by user supplied data should be looked at from the "might be exploitable in the future" perspective.
OK, I agree with this, but out of principle, not because there's a high chance it's remotely exploitable.