What I learned from my first C coding challenge
blog.jasonmooberry.com
What I learned from my first C coding challenge
1–10 of 85 posts
Re: What I learned from my first C coding challenge
#2I'm trying to picture a non-synthetic program where normalizing a URL is a significant part of the inner loop and I'm drawing a blank. Can someone help me out?
Re: What I learned from my first C coding challenge
#3Very interesting. The author at first seemed not that familiar with C, but in the end he got a good result
Depends also if there's pre validation (even with C you're never sure, so for example, reading that he used strcpy makes my head go "security hole", but this is a proof-of-concept so it's ok)
The best thing to keep in mind is that "There is no such thing as the fastest code"
Edit: strcmp to strcpy (or any str C function)
Re: What I learned from my first C coding challenge
#4Very interesting. The author at first seemed not that familiar with C, but in the end he got a good result Depends also if there's pre validation (even with C you're never sure, so for example, reading that he used strcpy makes my head go "security hole", but this is a proof-of-concept so it's ok) The best thing to keep in mind is that "There is no such thing as the fastest code" Edit: strcmp to strcpy (or any str C…
Reading strcmp() makes you think "security hole"? Why?
Re: What I learned from my first C coding challenge
#5When I read that, I feel OLD !
Re: What I learned from my first C coding challenge
#6Very interesting. The author at first seemed not that familiar with C, but in the end he got a good result Depends also if there's pre validation (even with C you're never sure, so for example, reading that he used strcpy makes my head go "security hole", but this is a proof-of-concept so it's ok) The best thing to keep in mind is that "There is no such thing as the fastest code" Edit: strcmp to strcpy (or any str C…
Reading strcmp() makes you think "security hole"? Why?
It doesn't take the length/amount of characters to compare as an argument relying on the null terminator, meaning it's susceptible to a buffer overflow attack.
Moral of the story, if you're going to use C strings, use the strn* variants.
Re: What I learned from my first C coding challenge
#7Very interesting. The author at first seemed not that familiar with C, but in the end he got a good result Depends also if there's pre validation (even with C you're never sure, so for example, reading that he used strcpy makes my head go "security hole", but this is a proof-of-concept so it's ok) The best thing to keep in mind is that "There is no such thing as the fastest code" Edit: strcmp to strcpy (or any str C…
Reading strcmp() makes you think "security hole"? Why?
strcmp() should be the least of security concerns. The input buffer in test.c is directly passed to the url_sort() function => Buffer overflow attacks.
Re: What I learned from my first C coding challenge
#8Very interesting. The author at first seemed not that familiar with C, but in the end he got a good result Depends also if there's pre validation (even with C you're never sure, so for example, reading that he used strcpy makes my head go "security hole", but this is a proof-of-concept so it's ok) The best thing to keep in mind is that "There is no such thing as the fastest code" Edit: strcmp to strcpy (or any str C…
Reading strcmp() makes you think "security hole"? Why?
It does not apply here, but strcmp is, due to the early bailout that any sane implementation uses, suspectible to timing attacks, as in http://www.cs.rice.edu/~scrosby/slides/SCISS-latency.1.ppt.
Re: What I learned from my first C coding challenge
#9As a note to the author about separating the arrays instead of using a structure, it was probably an alignment issue? Check out http://en.wikipedia.org/wiki/Data_structure_alignment
Re: What I learned from my first C coding challenge
#10Very interesting. The author at first seemed not that familiar with C, but in the end he got a good result Depends also if there's pre validation (even with C you're never sure, so for example, reading that he used strcpy makes my head go "security hole", but this is a proof-of-concept so it's ok) The best thing to keep in mind is that "There is no such thing as the fastest code" Edit: strcmp to strcpy (or any str C…
Reading strcmp() makes you think "security hole"? Why?
Actually I meant strcpy, but the point stands
Point your string function to a non-null terminated byte buffer for example. At the very least you can crash the app
What's recommended (one of the recommendations) is to use the 'n' functions like strncmp that takes a maximum size.