4 ms·
> trawling popular golang repos for: [0] == '\0' You may have misunderstood the code you read. if (mountsources[0] == '\0') { mountsources++;
by TheDong 5y ago
> trawling popular golang repos for: [0] == '\0'
You may have misunderstood the code you read.
if (mountsources[0] == '\0') {
mountsources++;
continue;
}
That portion of code is in C, not Go, so trawling most go repos for it won't help a bit.
The bug here is that data is passed between Go and C in the runc codebase, and the go and C code interpret the data differently.
Very few popular go repos use C programs, and even fewer in a way similar to runc (where it's not an existing mature C program being called or linked against, but rather hacking up their own C program that talks some internal hand-rolled protocol)
- watermelon0 5y agoWhat would be the reason to even use hand-rolled protocol instead of something commonly used, such as JSON or protobuf, which have properly tested C libraries with decent security record? I assume performance is not a problem, since it's only exchanging a small amount of data, so maybe they were aiming for the fact that less code means smaller attack surface?
- nicoburns 5y ago> What would be the reason to even use hand-rolled protocol instead of something commonly used, such as JSON or protobuf, which have properly tested C libraries with decent security record? Welcome to C culture, where external libraries are to be avoided at all costs.