News for hackers. Stuff that matters.
Re:The security hole in sudo by klez on Wednesday May 23, 2012 @10:54AM (#4013316)
The missing break has been the sort of bug that haunts me at least twice a month at my current job.

We do car diagnostics and we code in C. Endless time I would not understand why a particular path was not taken, and a missing break was the answer.

Now, I can see the utility of fall-thru switch construct, but this is a kind of bug that could be avoided at the syntax level. Just don't require a break and develop another syntax for fall-thru cases.

Re:The security hole in sudo by Bro_Merch on Wednesday May 23, 2012 @11:09AM (#4013390)
@klez

What exactly do you do? The reason I ask is because 50 hours a week I'm an Auto Tech. The remaining hours that I'm awake I code. This week my project has been reverse engineering a pc based scanner that I have to learn about how it interacts with OBDII / CAN in an attempt to make a super tool that gives me specific abilities. The people I deal with during day know nothing of computers and the people I deal with at night know nothing of cars.

You are the first person that I have ever heard mention both in the same post.

Re:The security hole in sudo by tonyarkles on Wednesday May 23, 2012 @11:32AM (#4013549)
This is pretty off-topic from the OP, but I want to point out that the ISO standard for OBD-II is a fantastic reference for this kind of project. We built an OBD-II reader for our engineering capstone project, and that ISO standard was an invaluable resource for getting things to work.

If there's a university nearby, you might want to go check out their engineering library and see if they have a copy. I don't recall the ISO number off the top of my head. If you're really serious about the project, I think the book only costs around $400 or so.

Re:The security hole in sudo by bri3d on Wednesday May 23, 2012 @12:18PM (#4013760)
Most of the "super abilities" provided by high-end scan tool / ECU flash packages work by using manufacturer-specific data sent over the CAN bus, not OBD-II itself.

Some newer and higher-end cars even use proprietary crypto keyed off of the VIN number and a shared secret to protect from access by third-party tools. There's a good-sized cottage industry in breaking proprietary ECU protocols and crypto, because there's a solid niche market in selling mechanics one $20,000 "multiflash" tool to replace their ten $10000 manufacturer-provided "diagnostic systems," especially in the high-end exotic market.

I was able to find enough resource online to build an ISO OBD-II scanner as my seventh-grade final project, without needing to resort to hunting down the standard. Today there are even open-source projects like http://en.wikipedia.org/wiki/OBDuino which can provide a solid code-based understanding of the three old OBD signaling types (PWM, VPW, ISO), as well as the basic protocol.

Re:The security hole in sudo by Bro_Merch on Wednesday May 23, 2012 @12:48PM (#4013896)
I'll let you all get back to topic at hand. I have to say thanks though. I never imagined getting so much helpful info. The super ability I seek seems like it would be in a less secure area because even cheap hardware store tools can do it. I am trying to remove, relocate, or hide fault codes without resetting the emissions monitors. That way as a hush hush marketing ploy of my business I can truly "guarantee to pass" and depending on the solution possibly guarantee to never fail again.

I hit an idea slump in my normal utility making and decided to put my otherwise wasted time to use.

Thanks Again ~

Re:The security hole in sudo by klez on Thursday May 24, 2012 @06:13AM (#4017659)
Of all the car I worked on (mostly Mitsubishi and Ssangyong) very few of them had non-standard procedures for erasing DTCs.

I don't know what you mean by 'erasing the emission monitor', unless you mean the freeze frame, which usually gets erased when you erase DTCs with the standard 0x14 request.

Anyway I work exactly as you do, by reverse-engineering official tools.

And I'm not very knowledgeable about cars anyway :)

Re:The security hole in sudo by ajross on Wednesday May 23, 2012 @11:46AM (#4013620)
Or just don't use switch. If it's a small expression, an if/else chain takes no more lines of code and is not less efficient. If it's a large expression, it might be better expressed with a function pointer table.

I'm not a zealot on this stuff, and write switch statements regularly (though I do strongly prefer if chains for most stuff) but if you're really hitting this regularly I think a change in process might be in order.

Re:The security hole in sudo by DHowett on Wednesday May 23, 2012 @12:14PM (#4013743)
It can be slightly less efficient when (on supporting architectures) the compiler could automatically generate a jump table in place of stacked conditionals, which it cannot do for a chain of ifs.
Re:The security hole in sudo by ajross on Wednesday May 23, 2012 @12:43PM (#4013870)
This is a myth that won't die. Jump tables can't be branch predicted, so they're generally significantly slower unless the number of cases is very high. And it's not true that the compiler "cannot" emit a jump table for an if chain anyway. A bunch of if/else-if expressions of the form "some_var == constant" can certainly be detected (though again, it probably isn't).
Re:The security hole in sudo by klez on Thursday May 24, 2012 @06:07AM (#4017649)
Unfortunately, I'm not able to decide to do this.

Most of our code is machine-generated, and our boss doesn't want to touch the generator in general.

Re:The security hole in sudo by toemetoch on Wednesday May 23, 2012 @01:20PM (#4014106)
Always close your stuff before filling it. E.g. instead of typing ...

switch (uint8_t bla){ case 0: stuff; ...

... and filling everything as you go along, first type the skeleton ...

switch () {case: break; default: break;}

... and then fill everything in. It's anal/pedantic but it becomes second nature really fast. Do it for everything (loops, structs, functions,...).

I once lost 2 entire days of my life I kid you not hunting an if (a = b) that had to be a == b and decided to change my approach.

Re:The security hole in sudo by altrego99 on Wednesday May 23, 2012 @12:01PM (#4013679)
I can empathize. I've always felt that implementation of switch statement in C is a bomb waiting to explode.

One of the many good decisions that went into C# is reversing how it works; in other words making it compulsory to explicitly state when you need control to fall from one case to another.

Re:The security hole in sudo by nknight on Wednesday May 23, 2012 @11:28AM (#4013524)
If you're having this kind of problem a lot, now might be an excellent time to start using a lint tool in your development process. It'll catch these things.
Re:The security hole in sudo by klez on Thursday May 24, 2012 @06:14AM (#4017665)
Long story short, coding standard and tooling are very poor at my current job.

I'm leaving in a week, so it won't be a problem for me anymore...