473,396 Members | 2,038 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,396 software developers and data experts.

Insecure Programming by example

Hi folks,

found an interesting C link here::
http://community.core-sdi.com/~gera/...reProgramming/

Dec 15 '05 #1
5 3156
aa*****@gmail.com said:
Hi folks,

found an interesting C link here::
http://community.core-sdi.com/~gera/...reProgramming/


I looked at the first example. Anyone programming like that needs a good
kicking.

--
Richard Heathfield
"Usenet is a strange place" - dmr 29/7/1999
http://www.cpax.org.uk
email: rjh at above domain (but drop the www, obviously)
Dec 15 '05 #2
Richard Heathfield wrote:
aa*****@gmail.com said:

Hi folks,

found an interesting C link here::
http://community.core-sdi.com/~gera/...reProgramming/

I looked at the first example. Anyone programming like that needs a good
kicking.


It's interesting that the example indulges in undefined
behavior (twice!) before arriving at what was probably the
point it was trying to make. One doesn't know whether the
author deserves praise or blame.

--
Eric Sosman
es*****@acm-dot-org.invalid
Dec 16 '05 #3

Eric Sosman wrote:
It's interesting that the example indulges in undefined
behavior (twice!) before arriving at what was probably the
point it was trying to make. One doesn't know whether the
author deserves praise or blame.


Similarly, all the argc and argv parameter conventions are reversed; is
that ignorance? or some sort of erudite gotcha for improperly trained
applicants? The whole thing feels like a red herring: which of the many
objectionable elements am I *supposed* to be objecting to... ?

Dec 16 '05 #4
aa*****@gmail.com said:
Hi all,

here are some more interesting links::-
http://www.cs.berkeley.edu/~ushankar.../percents.html
I have the very greatest of respect for David Wagner's cryptographic skills.
I would not ask him to write C code for me. (Sorry, David, if you ever read
this!)
http://www.cs.dartmouth.edu/~cs38/lo...mats-teso.html


Whoever wrote that needs a good kicking. Here's a quote:

++++
A format string is an ASCIIZ string that contains text and format parame-
ters.Example:

printf ("The magic number is: %s\n", 1911);
++++

In this tiny fragment, which is the first significant bit of C code in the
document, I count two oopses - one in the text and one in the code. Oops.

--
Richard Heathfield
"Usenet is a strange place" - dmr 29/7/1999
http://www.cpax.org.uk
email: rjh at above domain (but drop the www, obviously)
Dec 21 '05 #6

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

0
by: Ben Finney | last post by:
Howdy all, I'm using a library that uses SmartCookie. In Python 2.3, that gives this warning: /usr/lib/python2.3/Cookie.py:712: DeprecationWarning: Cookie/SmartCookie class is insecure; do...
4
by: Noen | last post by:
Im developing a game where the players will program their equipment with python. Are there any ways to run insecure code? I dont want the clients to mess with the server-code through their own...
4
by: Jeff | last post by:
The pickle module is so powerful. It has probably saved me thousands and thousands of lines of code over the years. It alone is enough to pursuede me to use Python in many instances. However,...
0
by: danpres2k | last post by:
Hi, I have following statements @filename = split("_", $cgi->param ('filename')); //similar multiline code $env_profile = $cgi->param ('env_profile'); $command = "/app/ics/bin/$input_app...
0
by: scorpion | last post by:
This question is more XML Security (and specifically, on the Apache XML security implementation). When I sign or open signed XML document, I see the following warning: .... WARNING: Found an...
8
by: werner | last post by:
Hi! I don't want to use eval() in order to parse a user-supplied formula. What alternatives do I have? PHP has no standard functionality for tokenizing or parsing expressions in this regard. ...
2
by: robert | last post by:
cPickle.loads raised "ValueError: insecure string pickle". The error is from a log file and I cannot reproduce it (quickly). What can be the cause for that error? Robert
3
by: Warren DeLano | last post by:
I would like to parse arbitrary insecure text string containing nested Python data structures in eval-compatible form: # For example, given a "config.txt" such as: { 'my_atom' : 1.20,...
0
by: Chris Rebert | last post by:
On Wed, Oct 8, 2008 at 5:34 PM, Warren DeLano <warren@delsci.comwrote: Assuming the data structures are sufficiently basic, i.e. no class instanciations, you can just use the json (AKA...
0
by: Charles Arthur | last post by:
How do i turn on java script on a villaon, callus and itel keypad mobile phone
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
0
by: emmanuelkatto | last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel
0
BarryA
by: BarryA | last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
0
by: Hystou | last post by:
There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
0
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
0
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
0
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...
0
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.