Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news2.arglkargh.de!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Jolly Roger <jollyroger@pobox.com>
Newsgroups: comp.sys.mac.system
Subject: Re: Latest IOS/OS X SSL security flaw
Date: 1 Mar 2014 21:52:30 GMT
Organization: People for the Ethical Treatment of Pirates
Lines: 38
Message-ID: <bnf34tFl9faU1@mid.individual.net>
References: <lears8$l8d$1@dont-email.me> <220220141415089899%nospam@nospam.invalid> <2NWdnQXy6oxRY5XOnZ2dnUVZ_qSdnZ2d@giganews.com> <53092980$0$9676$c3e8da3$aae71a0a@news.astraweb.com> <mcmurtrie-1A4D17.23011222022014@c-61-68-245-199.per.connect.net.au> <230220141438529316%nospam@nospam.invalid> <lee895$7u8$1@reader2.panix.com>
X-Trace: individual.net qIgwh94TY5xK8xu9v8IecAw23m4Ul+CHrGoPJj2WYXZoQNxQyS
Cancel-Lock: sha1:921X5UEPa8w+8be7n73eA98HcqA=
X-Face: _.g>n!a$f3/H3jA]>9pN55*5<`}Tud57>1<n@LQ!aZ7vLO_nWbK~@T'XIS0,oAJcU.qLM dk/j8Udo?O"o9B9Jyx+ez2:B<nx(k3EdHnTvB]'eoVaR495,Rv~/vPa[e^JI+^h5Zk*i`Q;ezqDW< ZFs6kmAJWZjOH\8[$$7jm,Ogw3C_%QM'|H6nygNGhhl+@}n30Nz(^vWo@h>Y%b|b-Y~()~\t,LZ3e up1/bO{=-)
User-Agent: slrn/1.0.1 (Darwin)
Xref: csiph.com comp.sys.mac.system:57317

On 2014-02-24, billy@MIX.COM <billy@MIX.COM> wrote:
> nospam <nospam@nospam.invalid> writes, quoting
> Kevin McMurtrie <mcmurtrie@pixelmemory.us>:
>
>> > The first two conditions can not be optimized away because they 
>> > influence the return value.  The code after the extra goto must be 
>> > removed, and that should have generated a warning.
>> 
>> it does. someone i know compiled an equivalent test app and xcode issue
>
> Equivalent test?  Any idiot (even you) could have grabbed the actual module
>
> http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c
>
> and ran a real test.  The unfixed version is still there, by the way.
>
>> a warning, which means the warning must have been ignored (or the
>> compiler was set to skip that check which is equally bad).
>
> From Adam Langley -
>
>| If I compile with -Wall (enable all warnings), neither GCC 4.8.2 or
>| Clang 3.3 from Xcode make a peep about the dead code. That's surprising
>| to me. A better warning could have stopped this but perhaps the false
>| positive rate is too high over real codebases? (Thanks to Peter Nelson
>| for pointing out the Clang does have -Wunreachable-code to warn about
>| this, but it's not in -Wall.)
>
> Billy Y..

As I suspected. Don't expect mr.know-it-all to admit he's wrong though.
It simply will not happen.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR