full-disclosure - Re: Firefox 2.0.0.7 has a very serious calculation bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5795.1191261082@turing-police.cc.vt.edu>
Date: Mon, 01 Oct 2007 13:51:22 -0400
From: Valdis.Kletnieks@...edu
To: wac <waldoalvarez00@...il.com>
Cc: Jimby Sharp <jimbysharp@...il.com>, full-disclosure@...ts.grok.org.uk
Subject: Re: Firefox 2.0.0.7 has a very serious
	calculation bug

On Mon, 01 Oct 2007 13:33:20 EDT, wac said:
> >
> > If I use strcpy() to read user input into a buffer, I am at fault and
> > not C compiler.
> 
> 
>  I don't think that's a fair comparison.
> If you make the right algorithm and you do not get the expected
> results *is* not
> your fault but what are you sitting at (compiler, framework, library ...).

No, it's still your fault.  The *actual* semantics of strcpy() are well
documented - if you use it incorrectly because your mental model of what the
"expected" results is broken, you're to blame.

It's only the library's fault if the provided strcpy() does not in fact
provide the actual documented semantics.  It isn't required to implement
the semantics the programmer *thought* it had.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/