Original Post
This most recent article, "Satan''s Syntax" is appropriately named, as some of it will definitely cause you much heart-ache (or heart-burn if you prefer) in the future.
Taking out large blocks of code with /* ... */? Uh, that only works if you don''t use /* */ within that code, because /* */ don''t nest on many compilers (in fact, i''ve never come across a compiler where they do, though i''m sure one exists). /* */ is great to take care of one-liners, but for large blocks of code, #if 0 works great, without all the trouble and potential bugs.
But this is but a small problem, as depending on your style, this will readily not work or work. No, the true EVIL in this article lies in the suggestion to use non-static char* variables for the 2nd arguement of sprintf(...). This, in itself is not a problem, but as soon as you let that string into the hands of a malicious user, %s''s and %h''s can be added to the format string to dump values from memory, crash programs, and other nasty things. It''s not that you shouldn''t use this technique at all, but please, at least warn people of this VERY REAL problem.
I believe there was a vulnrability of one of the major FTP servers relating to this, though i may be mixed up.
-benc
Taking out large blocks of code with /* ... */? Uh, that only works if you don''t use /* */ within that code, because /* */ don''t nest on many compilers (in fact, i''ve never come across a compiler where they do, though i''m sure one exists). /* */ is great to take care of one-liners, but for large blocks of code, #if 0 works great, without all the trouble and potential bugs.
But this is but a small problem, as depending on your style, this will readily not work or work. No, the true EVIL in this article lies in the suggestion to use non-static char* variables for the 2nd arguement of sprintf(...). This, in itself is not a problem, but as soon as you let that string into the hands of a malicious user, %s''s and %h''s can be added to the format string to dump values from memory, crash programs, and other nasty things. It''s not that you shouldn''t use this technique at all, but please, at least warn people of this VERY REAL problem.
I believe there was a vulnrability of one of the major FTP servers relating to this, though i may be mixed up.
-benc