4 ms·
I haven't thought about C in years - that one where author passes in a printf as a char array element and de-references it to execute it ... gives me chills. Y'
by SavageBeast 4y ago
I haven't thought about C in years - that one where author passes in a printf as a char array element and de-references it to execute it ... gives me chills. Y'all kids have fun - Im going to stick with my VM over here and call it a day. This makes even modern JS look sane by comparison. Excellent write up too.
- nneonneo 4y agoNit: the char array doesn’t get dereferenced at all. The entire computation happens as a side effect of computing the length of the array. This is more of a case where there’s an unexpected expression context that can be abused for fun.
- SavageBeast 4y agoThe fact the array element isn't in quotes bothers me to some degree - with or without its crazy but the fact that the compiler just accepts it as a language construct as opposed to a value makes me want to drink another beer. But again Im thinking dereferencing here - and as you said thats not the case.
- nneonneo 4y agoIt’s not an array element :) The printf statement is part of the length expression, i.e. it’s setting the length of the array to the result of the printf call. So it is indeed a “value”. This isn’t much different from writing something like this in JS: var a = []; a[console.log("Hello"), 1] = 42; except that this indexes the array as opposed to setting its length.
- SavageBeast 4y agoI spent the past 10 minutes figuring out what to search for (C is very rusty here) regarding C arrays and initialization. Now that you point it out, it seems obvious. It certainly wasn't obvious when I read it though. This is some really obtuse use of a language here - hilariously so really. The code in the array is executed as a function that determines the array size and I see that now - thanks. If someone on my team did this for any reason I'm not sure If Id shoot them or put them in charge of something more important. If no other thing - THIS is why code reviews exist. Still it's an impressive use of a compiler. Thanks for nit picking - this has been very entertaining!
- asguy 4y ago> I haven't thought about C in years ... Im going to stick with my VM over here and call it a day. What's your VM written in?
- kllrnohj 4y agoProbably not C regardless. How many widely used VMs are in C? Python is about it, right?
- Kamq 4y agoJava's? Or at least it used to be.
- kllrnohj 4y agoOpenjdk seems to be more c++ than c according to GitHub anyway. In particular the "interesting" stuff (so hotspot) looks to be all c++.
- asguy 4y agoIt started as C. It’s interesting to watch people post comments, as though C vs C++ makes the distinction in “safety” in a code base. The take away I’m getting is most have programmed in neither.
- legalcorrection 4y agoThese people are just regurgitating HN memes and then flailing when someone prods a bit deeper. C is basically the Donald Trump of HN. All rational thought goes out the door at the mere mention. In fact, you’re socially rewarded for joining the idiot mob.
- Banana699 4y agoSafe Rust. https://deno.land/ https://deno.land/
- lsof 4y agoThat printf exploit is quite impressive I think.