4 ms·
I don’t understand. Your link is talking about the difficulty of using these functions. But here, the functions are already being used. What’s missing is implem
by mikeash 7y ago
I don’t understand. Your link is talking about the difficulty of using these functions. But here, the functions are already being used. What’s missing is implementations of them. They chose to implement these functions without the security checks, but implementing them with the security checks is not hard.
- userbinator 7y agoThat whole article is basically saying that those extra checks are useless anyway in correctly written code, as otherwise it would be code that can be tested and reached: On the other hand, in code that does check for and attempts to handle errors reported by the APIs, the new error handling paths tend to be poorly tested (if at all) because the runtime-constraint violation can typically be triggered only once, the first time it is found and before it's fixed. After the flaw is removed, the handling code can no longer be tested and, as the code evolves, can become a source of defects in the program.
- microtherion 7y agoIt's possible that they are calling the functions, but passing incorrect length arguments so frequently that they are best ignored.