4 ms·

TL;DR Microsoft released a virus definition file with a timestamp/serial 220101001, and is unable to parse it into a (signed) long value since the largest value

by alblue 5y ago

TL;DR Microsoft released a virus definition file with a timestamp/serial 220101001, and is unable to parse it into a (signed) long value since the largest value is 2,147,483,647 and it’s possible that there’s a factor of 10 in the deserialisation logic.

ginko 5y ago
But 220,101,001 isn't larger than 2,147,483,647.. Did they get the number slightly wrong?
- cnorthwood 5y ago
  It also included a serial number following the date part of 001 (also 002, etc)
  - jonny_eh 5y ago
    Clearly this should stay a string. But I suspect they’re converting to an int to compare which definition is newer.
    - turminal 5y ago
      That would work just fine with a string comparison.
      - priansh 5y ago
        Yeah my first thought was, well you could lay out the timestamp in a way that supports lexicographical sorting, and then realized they had already done so. No reason this shouldn’t be a string!
        petee 5y ago
        It can be both. DNS serial numbers are YYYYMMDDnn, and it works just fine for humans, it is easy to convert, more compact, and you can compare in a single operation. Internally, there is no reason for it to be a string.
    - genocidicbunny 5y ago
      Comparing with strings ain't no panacea either. There's some suspicion that Windows 9 was skipped because a lot of old software checked for Windows 95 or 98 by just doing a string compare against "Windows 9". (For the record, I kind of doubt this was much of a concern by the time Windows '9' was being worked on, but there's a certain logic to it.)
  - mark-r 5y ago
    I think the point is that a 3 digit serial wouldn't be enough to cause overflow, it would need to be 4 digits. But who makes a post like that without using copy/paste to get it exactly right?
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- Cycl0ps 5y ago
  There's three 0s before the last 1. That pushes it over the edge of what a long int can handle
  - mark-r 5y ago
    I've gone back to the original just to double check. It's very consistent about having only 2 zeros before the last digit, not 3.
Flocular 5y ago
The error message " Can’t Convert “2201010001” to long." makes it seem like that was the timestamp/serial used (Would be yymmddHHMM format). No factor 10 in deserialisation needed for an overflow.
AshamedCaptain 5y ago

by alblue 5y ago

ginko 5y ago

But 220,101,001 isn't larger than 2,147,483,647.. Did they get the number slightly wrong?

cnorthwood 5y ago
It also included a serial number following the date part of 001 (also 002, etc)
- jonny_eh 5y ago
  Clearly this should stay a string. But I suspect they’re converting to an int to compare which definition is newer.
  - turminal 5y ago
    That would work just fine with a string comparison.
    - priansh 5y ago
      Yeah my first thought was, well you could lay out the timestamp in a way that supports lexicographical sorting, and then realized they had already done so. No reason this shouldn’t be a string!
      - petee 5y ago
        It can be both. DNS serial numbers are YYYYMMDDnn, and it works just fine for humans, it is easy to convert, more compact, and you can compare in a single operation. Internally, there is no reason for it to be a string.
  - genocidicbunny 5y ago
    Comparing with strings ain't no panacea either. There's some suspicion that Windows 9 was skipped because a lot of old software checked for Windows 95 or 98 by just doing a string compare against "Windows 9". (For the record, I kind of doubt this was much of a concern by the time Windows '9' was being worked on, but there's a certain logic to it.)
- mark-r 5y ago
  I think the point is that a 3 digit serial wouldn't be enough to cause overflow, it would need to be 4 digits. But who makes a post like that without using copy/paste to get it exactly right?
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
Cycl0ps 5y ago
There's three 0s before the last 1. That pushes it over the edge of what a long int can handle
- mark-r 5y ago
  I've gone back to the original just to double check. It's very consistent about having only 2 zeros before the last digit, not 3.

Flocular 5y ago

The error message " Can’t Convert “2201010001” to long." makes it seem like that was the timestamp/serial used (Would be yymmddHHMM format). No factor 10 in deserialisation needed for an overflow.

AshamedCaptain 5y ago