111–120 of 155 posts
This is so bad that it is hard to imagine how it could have escaped notice until now, Apple really need to beef up their security competence. Lets hope that malevolent hackers were similarly asleep.
Since the source code is available, might it be possible to produce a hot patch to the binary so that those of us running Mavericks won't have to go through the next few days or weeks with our pants down? It would be a simple matter of finding the JMP instruction generated by the second GOTO and replacing it with no-ops. How hard could it be,at least for someone who actually knows their way around OS X binary file fo…
Only if they used a truly stupid compiler. Chances are the unreachable code behind it got optimized away.
Since the source code is available, might it be possible to produce a hot patch to the binary so that those of us running Mavericks won't have to go through the next few days or weeks with our pants down? It would be a simple matter of finding the JMP instruction generated by the second GOTO and replacing it with no-ops. How hard could it be,at least for someone who actually knows their way around OS X binary file fo…
"It would be a simple matter of finding the JMP instruction generated by the second GOTO and replacing it with no-ops." Only if they used a truly stupid compiler. Chances are the unreachable code behind it got optimized away.
Odd. Apple updated iOS 7 and iOS 6 but didn't update Secure Transport in iOS 5? I wonder if the bug was introduced between iOS 5 and 6. Background on Secure Transport: "At the bottom of the TLS stack on both iOS and Mac OS X is a component known as Secure Transport. Secure Transport maintains a per-process TLS session cache. When you connect via TLS, the cache stores information about the TLS negotiation so that subs…
Earlier quoted context omitted.
I'm able to reproduce your results with cURL. However, Safari on OS X correctly shows a warning. Can anybody explain that?
cURL uses OpenSSL, Safari uses Apple's Secure Transport.
So, was this plus automatic updates over SSL one of the ways the NSA could access "any iOS device"?
Earlier quoted context omitted.
It appears to be, per https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 (and my own testing on OS X 10.9.1).
I'm able to reproduce your results with cURL. However, Safari on OS X correctly shows a warning. Can anybody explain that?
The lack of hostname checking for IP addresses in Apple's cURL is a completely different problem.
Earlier quoted context omitted.
Don't C compilers warn about code that is never executed? I'm actually pretty impressed how this bug was not caught before. The compiler warning is just one thing that came to my mind but test coverage should have been the strongest hint. A linter could have also make the thing easier for a code review. Probably these parts of the code should have stricter coding guideline.
You are 100% right. LLVM should fire a dead code warning here. However later code is used as a jump target for goto so it's quite hard for the compiler to infer this (or is it because its a different scope?). Either way, definitely avoidable. Looks typical of a merge cock up to me as the indentation is preserved suggesting it's a duplicate line or there was an if statement on the previous line that was removed.