Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news.stack.nl!aioe.org!.POSTED!not-for-mail
From: "Rod Pemberton" <dont_use_email@xnohavenotit.cnm>
Newsgroups: comp.lang.forth
Subject: Re: CASE mis-understanding?
Date: Mon, 24 Feb 2014 01:25:09 -0500
Organization: Aioe.org NNTP Server
Lines: 30
Message-ID: <op.xbrv37tz5zc71u@localhost>
References: <52e54d17.461102185@news.demon.co.uk> <2014Feb15.171430@mips.complang.tuwien.ac.at> <BYedna7sVMrCI2LPnZ2dnUVZ_rGdnZ2d@supernews.com> <2014Feb17.150541@mips.complang.tuwien.ac.at> <tqednXgs9PDrsp_OnZ2dnUVZ_jqdnZ2d@supernews.com> <ldtj28$72j$1@online.de> <waidnb0UgsHox5_OnZ2dnUVZ_uKdnZ2d@supernews.com> <2014Feb18.103428@mips.complang.tuwien.ac.at> <spadnZKuutcFoJ7OnZ2dnUVZ_oWdnZ2d@supernews.com> <2014Feb18.151937@mips.complang.tuwien.ac.at> <7xppmks7v9.fsf@ruckus.brouhaha.com> <2014Feb18.181426@mips.complang.tuwien.ac.at> <7xmwhoi4px.fsf@ruckus.brouhaha.com> <le2l28$v31$1@online.de> <7xeh2yi77o.fsf@ruckus.brouhaha.com> <le88kf$rau$1@online.de> <7xlhx2rckq.fsf@ruckus.brouhaha.com> <lebiui$b0s$1@online.de> <7xy51275wq.fsf@ruckus.brouhaha.com> <ledpee$pos$1@online.de>
NNTP-Posting-Host: CNsg4fVcCsvs3UaOgZtQCw.user.speranza.aioe.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
X-Complaints-To: abuse@aioe.org
User-Agent: Opera Mail/12.16 (Linux)
X-Notice: Filtered by postfilter v. 0.8.2
Xref: csiph.com comp.lang.forth:28729

On Sun, 23 Feb 2014 16:33:02 -0500, Bernd Paysan <bernd.paysan@gmx.de>  
wrote:

> Just yesterday, Apple issued an update to their SSL bug.  The culprit is
> just what we are discussion here: They rendered the final check on an SSL
> connection setup into dead code, by having duplicated line in a
> statement:
>
> if(err = somecheck(...))
>    goto fail;
>    goto fail;
> if(err = finalcheck(...))
>    goto fail;
>
> ...
>
> So the final check never was done.  Optimizing it away, even though that
> was by C's semantics the expressed intention of the programmer, was very
> harmful.
>

The problem here was the failure to use braces {} to delimit the body of
each if statement.  If they had done so, the mistake:
  1) would've been obvious, or
  2) wouldn't have had any effect

Not requiring braces for all blocks is another of C's design mistakes.


Rod Pemberton