Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!news.glorb.com!news.linkpendium.com!news.linkpendium.com!panix!MIX!Blackbird From: billy@MIX.COM Newsgroups: comp.sys.mac.system Subject: Re: Latest IOS/OS X SSL security flaw Date: Mon, 24 Feb 2014 01:46:13 +0000 (UTC) Organization: PANIX Public Access Internet and UNIX, NYC Lines: 32 Message-ID: References: <220220141415089899%nospam@nospam.invalid> <2NWdnQXy6oxRY5XOnZ2dnUVZ_qSdnZ2d@giganews.com> <53092980$0$9676$c3e8da3$aae71a0a@news.astraweb.com> <230220141438529316%nospam@nospam.invalid> NNTP-Posting-Host: panix5.panix.com X-Trace: reader2.panix.com 1393206373 8136 166.84.1.5 (24 Feb 2014 01:46:13 GMT) X-Complaints-To: abuse@panix.com NNTP-Posting-Date: Mon, 24 Feb 2014 01:46:13 +0000 (UTC) Xref: csiph.com comp.sys.mac.system:57302 nospam writes, quoting Kevin McMurtrie : > > The first two conditions can not be optimized away because they > > influence the return value. The code after the extra goto must be > > removed, and that should have generated a warning. > > it does. someone i know compiled an equivalent test app and xcode issue Equivalent test? Any idiot (even you) could have grabbed the actual module http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c and ran a real test. The unfixed version is still there, by the way. > a warning, which means the warning must have been ignored (or the > compiler was set to skip that check which is equally bad). From Adam Langley - | If I compile with -Wall (enable all warnings), neither GCC 4.8.2 or | Clang 3.3 from Xcode make a peep about the dead code. That's surprising | to me. A better warning could have stopped this but perhaps the false | positive rate is too high over real codebases? (Thanks to Peter Nelson | for pointing out the Clang does have -Wunreachable-code to warn about | this, but it's not in -Wall.) Billy Y.. -- sub #'9+1 ,r0 ; convert ascii byte add #9.+1 ,r0 ; to an integer bcc 20$ ; not a number