Anders Johansson wrote:
On Saturday 09 February 2008 04:01:23 Aaron Kulkis wrote:
grep -e "strcmp(\| gets(\|strcat(" *.c *.h
And how many do you think are in the habit of doing that regularly on their source repositories?
Any programmer with a clue. When I was a student at Purdue, these sorts of tests were run on all program class assignments, as well as automated execution to test for input/output correctness, automatic grade reduction for late submissions, etc. Electrical Engineering and Computer Science each had their own, separately developed grading suites, but these sorts of things were well established even in the 1980's. How do I know? Because the profs made the grading software available (for execution) to students in the introductory-level classes -- the idea being to get the students to develop good programming practices from the beginning, rather than playing, "gotcha!" over easily-corrected errors.
Most security vulnerabilities you see reported have been in the code for a moderately long time. There are far more problematic functions than the ones you describe, and grepping for them all is simply not done on a regular basis. But ok, how's this then
buffer_size = 10 char buffer[10];
ANY literal in an array declaration should be worth one police night-stick to the side of the head. That's the kind of stuff that gets severe reprimands and grade reductions even in SOPHOMORE level classes at any reputable college or university.
strncat(buffer, things_read_from_the_net, buffer_size);
and then someone does s/buffer_size = 10/buffer_size = 1000/
grep for that
Which is why literals should NEVER be used in programs. And again, why any university with a respected curriculum in computer science or electrical engineering completely breaks such habits of its students by the time they graduate.
Anders
-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org