3 ms·

xz maintainer just pushed this "CMake: Fix sabotaged Landlock sandbox check." commit https://git.tukaani.org/?p=xz.git;a=commitdiff;h=f9cf4c05edd14dedfe63833f8

• radicality 3y ago
  Which was sneakily introduced here: https://git.tukaani.org/?p=xz.git;a=commitdiff;h=328c52da8a2bbb81307644efdb58db2c422d9ba7 https://git.tukaani.org/?p=xz.git;a=commitdiff;h=328c52da8a2...
  • sega_sai 3y ago
    Even knowing that it was a dot added, I could not quite easily find this in the diff. Scary...
  • tadfisher 3y ago
    Wow, just the process of sneaking in this exploit has layers. Here, it's the presentation of diffs with "+" and "-" line prefixes creating noise that's easy to miss. I bet we'll start seeing tools add a divider between the prefix column and the contents to make changes like this easier to spot. That said, does GCC accept every non-printing character as whitespace? If not, they could probably have achieved the same thing with a narrow-nonbreaking-space character or similar.
    • thenewwazoo 3y ago
      I got curious, so: ~/t [main L|…1]$ gcc test.c ~/t [main L|…1]$ vi test.c ~/t [main L| 1…1]$ git diff diff --git a/test.c b/test.c index 33c14ce..dc93007 100644 --- a/test.c +++ b/test.c @@ -1,3 +1,3 @@ int main() { - return 0; + return 0; } ~/t [main L| 1…1]$ gcc test.c test.c:2:5: error: expected expression <U+0008>return 0; ^ 1 error generated. So, yes, this could have been made to look exactly like a meaningless whitespace change.