Re:Advice for Computer Science College Students
by InclinedPlane on Tuesday May 04, 2010 @02:59AM
(#1317349)
There is a nasty bug in it, a buffer overrun bug. If, for any reason, t is not properly null terminated, then you'll have a problem. If, for any reason, s is not at least as large of a buffer as t, then you'll have a problem.
How bad of a problem? Well, quite potentially the worst kind: a serious buffer overflow problem that could result in a remote execution vulnerability. This is just the sort of thing that gets patched every Tuesday as engineers come to the "oh shit!" realization that yet another bit of crusty code using some ancient "clever" (actually lazy) idiom has been sitting around just waiting for some ne'er do well to take advantage of it and create yet another 400,000 system botnet.
It's good to have a solid knowledge of C programming fundamentals, but actually writing good, safe C code is non-trivial. Moreover, the mentality that one can just slap together some "efficient" C code and ship it out the door has resulted in more heartache and more sysiphean turd polishing than almost any other single software engineering mistake.
How bad of a problem? Well, quite potentially the worst kind: a serious buffer overflow problem that could result in a remote execution vulnerability. This is just the sort of thing that gets patched every Tuesday as engineers come to the "oh shit!" realization that yet another bit of crusty code using some ancient "clever" (actually lazy) idiom has been sitting around just waiting for some ne'er do well to take advantage of it and create yet another 400,000 system botnet.
It's good to have a solid knowledge of C programming fundamentals, but actually writing good, safe C code is non-trivial. Moreover, the mentality that one can just slap together some "efficient" C code and ship it out the door has resulted in more heartache and more sysiphean turd polishing than almost any other single software engineering mistake.