Re: C's trikery semantic opens up backdoor in new Linux kernel

["Warren W. Gay VE3WWG" <ve3wwg@cogeco.ca>]

Vinzent 'Gadget' Hoefler wrote:
> J Cusick wrote:
>>On Wed, 12 Nov 2003 04:26:44 +0000, Stephane Richard wrote:
>>>For some reason, I can't open that link you posted here..
>>
>>The Register site seems to be down at the moment... The link is good.
>>
>>The article discusses the fact that someone tried to slide in a C line 
>>(actually 2 lines) that trashed the tcp stack allowing a negative offset
> 
> No. It is worse than that.
> 
> The interesting line in question is this one:
> 
> |if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
> 
> First this looks like a sanity check. But look closer. This single
> line serves one single purpose: to give you root-privileges when you
> just pass the right flags. Note the "current->uid = 0" instead of
> "current->uid == 0". Who the hell had the ******* bad idea that
> assignments could return values?

It was a matter of time before this happened. But to be fair to
C, this is a problem with any large body of code. How carefully
is every source line submission scrutinized?

As the quantity of code increases, the likelyhood of some other
subtle change like this being introduced increases. Linux as
Open Source enjoys the advantage of many eyes, which helps. But
it also enjoys the slight disadvantage of "many submissions" as
well ;-)

I do accept that Ada95 would make this more difficult to do,
but this seems to be all academic talk for the moment ;-)

-- 
Warren W. Gay VE3WWG
http://home.cogeco.ca/~ve3wwg