5 ms·

Wow, what a bug. The malware scanning service of MS Exchange crashes, because it treats a yyMMddHHmm timestamp as a signed integer when verifying a signature f

Wow, what a bug. The malware scanning service of MS Exchange crashes, because it treats a yyMMddHHmm timestamp as a signed integer when verifying a signature file. Turns out that 2201010001 is negative when treated as a 32 bit integer (the greatest positive one is 2147483647, and 2021 had fewer than 47 months). I can only assume that somebody wrote that "timestamp string as integer" code, checked that it worked correctly (at the time) and then just assumed they must be good on data type range.

deleted 5y ago
[deleted]
crehn 5y ago
Surprised this sort of hack would even pass code review.
- hn_throwaway_99 5y ago
  Really? Billions of lines of code is reviewed every year at Microsoft. Not hard for me to imagine that this was coerced to an int somewhere (perhaps even unintentionally) that was non-obvious during a code review.
PostThisTooFast 5y ago
jeroenhd 5y ago
I think it probably developed the other way around, same as the version information almost every DNS server uses. The anti malware releases probably started out with definition version 1, 2, 3, and so on, until someone complained that version 37363 doesn't mean much. Some smart guy probably realised that as long as the numbers increased, they could put anything in there, so the 1201010000 version was born, incremented a day at a time. As MXToolbox states: > The serial number is an unsigned 32 bit value assigned to your SOA record must be between 1 and 4294967295. […] It has become common to set your serial number with a date format to make it easier to to manage. This format uses 10 digits to represent the date and then a two digit sequence number with the format of YYYYmmddss. Do any SOA query against hosted DNS and you'll probably see exactly this pattern appear. The fact they used a long go store the version also suggested that someone may not have realised that longs are the same size as its, depending on your platform and compiler. The effective distinction between the two in Microsoft's compiler ended in the 32 bit era, so using a long to store anything might be seen as a red flag. Based on the fix linked, the current antimalware release seems to be based on December 33rd, 2021. That will buy them enough time to write a patch that just uses long longs for these timestamps, or if their customers don't like installing updates they might just go back to incrementing the number by one at some point.

deleted 5y ago

[deleted]

crehn 5y ago

Surprised this sort of hack would even pass code review.

hn_throwaway_99 5y ago
Really? Billions of lines of code is reviewed every year at Microsoft. Not hard for me to imagine that this was coerced to an int somewhere (perhaps even unintentionally) that was non-obvious during a code review.

PostThisTooFast 5y ago

jeroenhd 5y ago

I think it probably developed the other way around, same as the version information almost every DNS server uses. The anti malware releases probably started out with definition version 1, 2, 3, and so on, until someone complained that version 37363 doesn't mean much. Some smart guy probably realised that as long as the numbers increased, they could put anything in there, so the 1201010000 version was born, incremented a day at a time. As MXToolbox states: > The serial number is an unsigned 32 bit value assigned to your SOA record must be between 1 and 4294967295. […] It has become common to set your serial number with a date format to make it easier to to manage. This format uses 10 digits to represent the date and then a two digit sequence number with the format of YYYYmmddss. Do any SOA query against hosted DNS and you'll probably see exactly this pattern appear. The fact they used a long go store the version also suggested that someone may not have realised that longs are the same size as its, depending on your platform and compiler. The effective distinction between the two in Microsoft's compiler ended in the 32 bit era, so using a long to store anything might be seen as a red flag. Based on the fix linked, the current antimalware release seems to be based on December 33rd, 2021. That will buy them enough time to write a patch that just uses long longs for these timestamps, or if their customers don't like installing updates they might just go back to incrementing the number by one at some point.