News for hackers. Stuff that matters.

A comment on The cost of forsaking C. Parent comment

Re:The cost of forsaking C by rwmj on Wednesday October 05, 2016 @08:24AM (#12643168)
Signed overflow problems are everywhere, even in carefully written code. Using 'int' instead of a more specific type is a code smell. Security code which presumes that because you wrote ptr != NULL, that the check is actually carried out. Code that does type punning. Code that doesn't know about aliasing. It goes on and on.

You need to know that the problem exists in order to know that you have a problem. There are many C programmers who learned C back in the 1980s who don't even realize these are issues.

[ Parent | on HN ]
Re:The cost of forsaking C by tarancato on Wednesday October 05, 2016 @08:33AM (#12643220)
I'd say things have changed quite a bit since format string bugs...
[ Parent | on HN ]
Re:The cost of forsaking C by MaulingMonkey on Wednesday October 05, 2016 @08:50AM (#12643335)
Since?

I'm still adding the compiler specific annotations to add format string checking to custom variadic logging functions in codebases I inherit, and finding multiple bugs.

[ Parent | on HN ]