Full Disclosure mailing list archives
RE: Coding securely, was Linux (in)security
From: "Chris Eagle" <cseagle () redshift com>
Date: Sun, 26 Oct 2003 20:46:55 -0800
-----Original Message----- From: Brett Hutley [mailto:brett () hutley net] So you're saying I don't need to worry if a file pointer is NULL before passing it through to fprintf()? So I don't need to worry if an argument to strcpy() is NULL? Or are you trying to say that the standard library is badly written?
Nope, I never said the caller shouldn't check what they pass. But, the subroutine should NEVER assume that the caller has checked. I find it comical that others in this thread say in one breath, you should always validate user supplied input, but in another breath that subroutines should not be responsible for validating supplied parameters. A subroutine that states something like "never pass in a NULL pointer" and then chokes when someone does is poorly coded, plain and simple. If that applies to functions in the standard library then yes it is badly written. Undefined behavior in response to unexpected inputs is always a problem. Are you saying that subroutine authors should rely on the "good will" of callers to supply only valid arguments? Microsoft seems to take that approach regarding user input validation and it clearly doesn't work Chris _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Coding securely, was Linux (in)security, (continued)
- Re: Coding securely, was Linux (in)security Valdis . Kletnieks (Oct 26)
- Re: Coding securely, was Linux (in)security Brett Hutley (Oct 26)
- Re: [inbox] Re: RE: Linux (in)security Bill Royds (Oct 26)
- Re: [inbox] Re: RE: Linux (in)security Bruce Ediger (Oct 26)
- Re: [inbox] Re: RE: Linux (in)security Stormwalker (Oct 27)
- Re: [inbox] Re: RE: Linux (in)security Bill Royds (Oct 27)
- Re: [inbox] Re: RE: Linux (in)security Bruce Ediger (Oct 27)
- Message not available
- Coding securely, was Linux (in)security Paul Schmehl (Oct 26)
- RE: Coding securely, was Linux (in)security Chris Eagle (Oct 26)
- Re: Coding securely, was Linux (in)security Brett Hutley (Oct 26)
- RE: Coding securely, was Linux (in)security Chris Eagle (Oct 26)
- Re: Coding securely, was Linux (in)security Brett Hutley (Oct 26)
- Off topic programming thread Mortis (Oct 26)
- Re: Off topic programming thread Bill Weiss (Oct 27)
- Re: Off topic programming thread Chris Smith (Oct 27)
- RE: Coding securely, was Linux (in)security Paul Schmehl (Oct 26)
- Re: Coding securely, was Linux (in)security Bill Royds (Oct 26)
- Re: Coding securely, was Linux (in)security Valdis . Kletnieks (Oct 26)
- Re: Coding securely, was Linux (in)security Brett Hutley (Oct 26)
- RE: Coding securely, was Linux (in)security Chris Eagle (Oct 26)
- RE: Coding securely, was Linux (in)security Steve Wray (Oct 27)