Apple's SSL/TLS bug

Post by kps » Sat, Feb 22, 2014, 4:40 PM UTC

tobiasu wrote: post #33

Pacabel wrote: post #24

Earlier quoted context omitted.

Those kinds of tools aren't new or emerging. The "indent" utility for C has been around for decades. I first remember using it on 4.3BSD, but it may have been around before that.

indent - indent and format C program source HISTORY The indent command appeared in 4.2BSD. And for context, 4.2BSD was released in 1983.

  NAME
    cb - C program beautifier

  SYNOPSIS
    cb

  DESCRIPTION
    Cb  places a copy of the C program from the standard input on the stan-
    dard output with spacing and indentation that displays the structure of
    the program.

Post by bentcorner » Sat, Feb 22, 2014, 4:44 PM UTC

praseodym wrote: post #83

oneeyedpigeon wrote: post #72

Earlier quoted context omitted.

The real WTF is those Warn flags, then. In what sane world does "extra" mean more than "all", and "all" and "everything" mean different things?

Apple introduced -Weverything because suddenly changing the scope of gcc's -Wall (which indeed does not include everything) would break a lot of builds.

Post by voidlogic » Sat, Feb 22, 2014, 4:46 PM UTC

acdha wrote: post #95

voidlogic wrote: post #74

Earlier quoted context omitted.

I agree, I was thinking about what this situation would look like in other langs and when I turned to Go, I realized: While Go has goto for tricky situations like this, because it has defer you don't have to use it often, assuming the free calls were needed (and the vars were not going to be GC'd): defer SSLFreeBuffer(&hashCtx) defer SSLFreeBuffer(&signedHashes) if err = SSLHashSHA1.update(&hashCtx, &serverRandom); e…

I would probably flag the code above in a security review because it hides the key part at the end of a complex line. Unless you're coding on VT100 terminal it's worth the extra line to make the test logic incredibly obvious: err = SSLHashSHA1.update(&hashCtx, &serverRandom); if (err != nil) { return err; }

Post by bunderbunder » Sat, Feb 22, 2014, 4:53 PM UTC

kps wrote: post #97

badman_ting wrote: post #3

If blocks without curly braces ಠ_ಠ

Braces don't help in coding styles that put the opening brace on a separate line from the control statement. if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0) { goto fail; } { goto fail; }

  if (condition)
  {
    doSomething();
  }

  if (condition)
  {
    doSomething();
  }
  {
    doAnotherThing();
  }

  if (condition)
  {
    doSomething();
    doAnotherThing();
  }

  if (condition)
    doSomething();
    doAnotherThing();

Post by lucian1900 » Sat, Feb 22, 2014, 4:58 PM UTC

kps wrote: post #97

badman_ting wrote: post #3

If blocks without curly braces ಠ_ಠ

Braces don't help in coding styles that put the opening brace on a separate line from the control statement. if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0) { goto fail; } { goto fail; }