| |||||||||||||
Nonsense. This is trivial stuff.Nonsense. This is trivial stuff.Posted Jul 18, 2009 10:05 UTC (Sat) by bojan (subscriber, #14302)In reply to: Nonsense. This is trivial stuff. by spender Parent article: Linux 2.6.30 exploit posted
Yeah, I get that. I'm referring to the code itself, which on its face is trivially wrong. In other words, the check whether tun==NULL should be _before_ sk=tun->sk, not after it.
(Log in to post comments)
Nonsense. This is trivial stuff. Posted Jul 20, 2009 8:07 UTC (Mon) by bojan (subscriber, #14302) [Link]
After reading some of the C spec (http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1336.pdf), section 6.3.2.3 has this:
> An integer constant expression with the value 0, or such an expression cast to type void *, is called a null pointer constant.57) If a null pointer constant is converted to a pointer type, the resulting pointer, called a null pointer, is guaranteed to compare unequal to a pointer to any object or function.
So, my guess is that GCC folks simply put two and two together and got four. In other words, if tun was zero, it would not be pointing to any valid object. Therefore, the fact that the programmer is using it must mean that the programmer _knows_ that it will be pointing to a valid object (i.e. is non-zero). Therefore, the check for it being zero later on is superfluous and can be removed. Ergo, no bug in GCC.
|
|||||||||||||