Not logged in
Log in now
Create an account
Subscribe to LWN
LWN.net Weekly Edition for May 16, 2013
A look at the PyPy 2.0 release
PostgreSQL 9.3 beta: Federated databases and more
LWN.net Weekly Edition for May 9, 2013
(Nearly) full tickless operation in 3.10
The BSD manual page and the Linux manual page do differ on that point:
MySQL flaw leaves some systems wide open
Posted Jun 14, 2012 11:29 UTC (Thu) by scottt (subscriber, #5028)
Posted Jun 15, 2012 1:48 UTC (Fri) by wahern (subscriber, #37304)
They both define the exact same behavior. But you have to know what "greater than" and "less than" means to fully understand the Linux man page. To know that you have to go to the C standard:
The sign of a nonzero value returned by the comparison functions memcmp, strcmp, and strncmp is determined by the sign of the difference between the values of the first pair of characters (both interpreted as unsigned char) that differ in the objects being compared. (C11 7.23.4, C99 7.21.4)
The BSD man page just incorporates that definition to makes things crystal clear.
Posted Jun 15, 2012 2:35 UTC (Fri) by zlynx (subscriber, #2285)
"The sign of the nonzero value" is "determined by the sign of the difference"
That says nothing about how large the return value may be. It doesn't require that it be a signed char.
Posted Jun 15, 2012 3:48 UTC (Fri) by wahern (subscriber, #37304)
The fundamental issue is people not understanding (or at least not applying their knowledge of) implicit conversions in C, and I'm entirely unsurprised that MySQL ran afoul of the rules. I had to emulate the MySQL password code in an asynchronous client library several years ago. I took one look at MySQL's code and my head spun. It's classic I-know-enough-C-to-be-dangerous. I translated to paper the algorithm that it was attempting, poorly, to implement, and then promptly purged my mind of the actual code so it wouldn't infect my own implementation.
Posted Jun 15, 2012 4:06 UTC (Fri) by wahern (subscriber, #37304)
Now, anyone have any tips on turning time back so I can erase my comment? =)
Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds