6 ms·

>a truncation error on a cast of a floating point value to a 16-bit integer played a crucial role in the destruction of Ariane 5 flight 501 in 1996. These error

>a truncation error on a cast of a floating point value to a 16-bit integer played a crucial role in the destruction of Ariane 5 flight 501 in 1996. These errors are also a source of serious vulnerabilities, such as integer overflow errors in OpenSSH [MITRE Corporation 2002] and Firefox [MITRE Corporation 2010], both of which allow attackers to execute arbitrary code. In their 2011 report MITRE places integer overflows in the “Top 25 Most Dangerous Software Errors” [Christey et al. 2011]. Wow, that's more than a little enlightening.

aomix 10y ago
The OpenBSD devs were really enthusiastic about reallocarray as a way to catch some integer overflow issues like the OpenSSH issue.
ArkyBeagle 10y ago
This is absolutely true and greatly increases the cognitive load from using 'C'. IMO, all systems which use 'C' need a great deal of test furniture and possibly code analyzers to manage this. And of course, nobody wants to pay for this. But I mean - if you have not done a basic fuzz test of the thing then you have really no idea. What would be interesting is a series of experiments to directly contrast the Therac, Ariane and OpenSSL errors using something like Rust. As I understand it, there still may well have been a crash of some sort.
_kst_ 10y ago
It's interesting that the article mentions the Ariane 5 bug, but doesn't mention that the Ariane 5 software (at least the component that caused the bug) was written in Ada, not C. The real problem is that the Ariane 4 software was used without re-testing for the new rocket. The overflow could not occur on the Ariane 4. The higher acceleration of the Ariane 5 resulted in the overflow. The overflow was caught by the Ada runtime system, and generated an error message. The error message was then processed as data.
- junke 10y ago
  This is not targetted directly at you, but when I spot people talk about Ariane 5, it is generally only to cover one particular aspect of the bug which confirms their personal opinion or agenda. So for reference, here is the full report: https://www.ima.umn.edu/~arnold/disasters/ariane5rep.html https://www.ima.umn.edu/~arnold/disasters/ariane5rep.html > 3.2 CAUSE OF THE FAILURE > The failure of the Ariane 501 was caused by the complete loss of guidance and attitude information 37 seconds after start of the main engine ignition sequence (30 seconds after lift- off). This loss of information was due to specification and design errors in the software of the inertial reference system. > The extensive reviews and tests carried out during the Ariane 5 Development Programme did not include adequate analysis and testing of the inertial reference system or of the complete flight control system, which could have detected the potential failure. </quote> Some interpretations: Put it in the contract: The lessons of Ariane (https://www.irisa.fr/pampa/EPEE/Ariane5.html https://www.irisa.fr/pampa/EPEE/Ariane5.html) The Ariane 5 bug and a few lessons (http://www.leshatton.org/Documents/Ariane5_STQE499.pdf http://www.leshatton.org/Documents/Ariane5_STQE499.pdf) I heard tell that Ada was to blame for the Ariane V disaster. Is this true? (http://www.adapower.com/index.php?Command=Class&ClassID=FAQ&CID=328 http://www.adapower.com/index.php?Command=Class&ClassID=FAQ&...)

aomix 10y ago

The OpenBSD devs were really enthusiastic about reallocarray as a way to catch some integer overflow issues like the OpenSSH issue.

ArkyBeagle 10y ago

This is absolutely true and greatly increases the cognitive load from using 'C'. IMO, all systems which use 'C' need a great deal of test furniture and possibly code analyzers to manage this. And of course, nobody wants to pay for this. But I mean - if you have not done a basic fuzz test of the thing then you have really no idea. What would be interesting is a series of experiments to directly contrast the Therac, Ariane and OpenSSL errors using something like Rust. As I understand it, there still may well have been a crash of some sort.

_kst_ 10y ago

It's interesting that the article mentions the Ariane 5 bug, but doesn't mention that the Ariane 5 software (at least the component that caused the bug) was written in Ada, not C. The real problem is that the Ariane 4 software was used without re-testing for the new rocket. The overflow could not occur on the Ariane 4. The higher acceleration of the Ariane 5 resulted in the overflow. The overflow was caught by the Ada runtime system, and generated an error message. The error message was then processed as data.

junke 10y ago
This is not targetted directly at you, but when I spot people talk about Ariane 5, it is generally only to cover one particular aspect of the bug which confirms their personal opinion or agenda. So for reference, here is the full report: https://www.ima.umn.edu/~arnold/disasters/ariane5rep.html https://www.ima.umn.edu/~arnold/disasters/ariane5rep.html > 3.2 CAUSE OF THE FAILURE > The failure of the Ariane 501 was caused by the complete loss of guidance and attitude information 37 seconds after start of the main engine ignition sequence (30 seconds after lift- off). This loss of information was due to specification and design errors in the software of the inertial reference system. > The extensive reviews and tests carried out during the Ariane 5 Development Programme did not include adequate analysis and testing of the inertial reference system or of the complete flight control system, which could have detected the potential failure. </quote> Some interpretations: Put it in the contract: The lessons of Ariane (https://www.irisa.fr/pampa/EPEE/Ariane5.html https://www.irisa.fr/pampa/EPEE/Ariane5.html) The Ariane 5 bug and a few lessons (http://www.leshatton.org/Documents/Ariane5_STQE499.pdf http://www.leshatton.org/Documents/Ariane5_STQE499.pdf) I heard tell that Ada was to blame for the Ariane V disaster. Is this true? (http://www.adapower.com/index.php?Command=Class&ClassID=FAQ&CID=328 http://www.adapower.com/index.php?Command=Class&ClassID=FAQ&...)