Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

My favourite part:

> The following strcmp and strlen functions were written and published when the processors with SSE 4.2 support were not available yet. Later they were tested on real hardware and found to be correct.

Too many programmers often think of programming as an online operation - online with stackoverflow, the manual, npm install, and so on -- and in a world of always-online it's hard to justify "wasting" precious mental-space preserving the ability to program in a wifi-free zone like an airplane or on the underground, but you need the ability to think about your software to program on the chip that doesn't exist yet, so this may be interesting to meditate over from time to time.



There was a fun MySQL bug[1] a while back involving similar functions and SSE(I think) instructions where the MySQL check was something like:

   if((my_bool)memcmp(password, hash) == 0)
Except that the SSE function would return nonzero of > 256 which would truncate to 0. Since the hash was seeded with time you could just spin-lock your way to entry on any system of that arch.

So while they may have been "correct" there's always fun implications when you deploy them in the wild.

[1] - https://nvd.nist.gov/vuln/detail/CVE-2012-2122


Intel provides a tool that emulates instructions which are unsupported by the host CPU, so it's likely that the code was tested before hardware became available.

https://software.intel.com/en-us/articles/intel-software-dev...

> Intel is releasing this Intel SDE so that developers can gain familiarity with our upcoming instruction set extensions.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: