Type Confusion

The shape

Two classes with the same memory size but different field layouts:

Both occupy 32 bytes. ImageBuffer.width is at +0x00; ScriptHandler.callback is also at +0x00. If the runtime allocates an ImageBuffer and the attacker sets width = 0x401234, then a buggy cast lets the code interpret the same memory as a ScriptHandler — and now callback is a function pointer to 0x401234. Calling handler->callback(...) jumps to attacker-controlled code.

Where it shows up

1. C / C++ unsafe casts (reinterpret_cast)

2. C unions without a tag

Unions share memory between members. If the code writes to one variant and reads from another without checking which is currently valid, it's type confusion by design.

3. C++ downcasting

Casting a base class to a derived class without verifying the actual runtime type. If the object is really a different sibling class, fields are at wrong offsets.

The correct C++ form — dynamic_cast<Dog*>(a) — returns nullptr if a isn't really a Dog. But dynamic_cast requires RTTI and is slower, so codebases often use the unchecked C-style cast.

4. JavaScript engine JITs

This is the home turf of modern type-confusion exploitation. V8, JavaScriptCore, SpiderMonkey all watch how variables are used and compile specialized fast paths assuming consistent types. If the engine's guard on the type is missing or wrong, the JIT's compiled code executes type-specialized operations on the wrong type. The exploit shape is:

1. Train the JIT to assume x is always an integer array.
2. Trigger the compiled fast path.
3. During execution, secretly replace x with an object array (Type Confusion!).
4. The compiled code does integer arithmetic on the object pointers, treating object addresses as int values.
5. Result: arbitrary read/write primitive, full RCE within the renderer process.

Almost every Pwn2Own browser win in the last decade has been a type confusion in the JIT. Both the incommensurable — the JIT is incredibly complex — and the incentive — speed matters — make this fertile ground for bugs.

Famous incidents

Defenses

1. Use safe casts

In C++, prefer dynamic_cast with a null check over C-style casts. Pay the RTTI overhead. In codebases that have explicitly opted out of RTTI for size, use a custom tagged-type system: every object carries a type ID, every cast checks the ID before reinterpreting.

2. Tag your unions

Replace bare C unions with tagged structures: a discriminator field that says which variant is current. Standardized as std::variant<A,B,C> in C++17, which throws on invalid access. Rust's enums encode the tag in the type system — type confusion of this form is impossible.

3. Sanitize during testing

-fsanitize=cfi (Control Flow Integrity) catches some type-confusion-derived indirect calls at runtime. UBSan with -fsanitize=vptr catches polymorphic class confusion. Use in CI; fix every report.

4. Compile-time static analysis

Clang's -Wcast-align, -Wstrict-aliasing; tools like CodeQL and Semmle can find suspicious casts. Not a silver bullet but reduces the surface.

5. Memory-safe languages

Rust's type system makes the structural form of this bug impossible — every cast must be explicit and checked. Go has interface assertion (x.(*Foo)) that returns a second boolean. C#, Java, Swift all type-check at runtime.