Re:OpenSSL 3.0.7 Published
by bewaretheirs on Tuesday November 01, 2022 @12:35PM
(#33423574)
Looks to me like a coding style fix along for the ride with the correctness fix.
I don't think that's security-relevant, likely just keeping a linter happy.
Ah, I didn't think about a linter. I'll take a look at the code later to see if that's the case.
sizeof is a keyword because of some terrible reason, but I'd parenthesize it just to make the intention clear.
Re:OpenSSL 3.0.7 Published
by Sohcahtoa82 on Tuesday November 01, 2022 @12:55PM
(#33423856)
Agreed. sizeof FEELS like a function, and so I use parentheses with it, even though I know it's not actually a function.
Wasn't there some subtle difference between using sizeof with vs without parens? Something like if you pass a type to sizeof -- e.g. sizeof(*int) -- you must use parents anyway? It's been years since I've used C, I'm probably not remembering it correctly.
Yes, exactly that. `sizeof(int)` OK, `sizeof(i)` OK, `sizeof i` OK, `sizeof int` not OK. One of those weird rules.
Why is sizeof a terrible keyword? Just think of it as an operator rather than a function.
I guess I can understand resolving an ambiguity so that the reader doesn't have to look up precedence rules. But when combined with a high-profile bug in a critical piece of infrastructure it looks a bit like the software equivalent of not shaving one's beard in the hopes of winning a sports tournament.