This is a nice summary: https://lcamtuf.blogspot.com/2014/10/psa-dont-run-strings-on...