Fastjson just fixed a bug which might cause service down a few days ago. This bug is caused by some mishandling of special character \x which is an escaped character to indicate hexdecimal number. The impact of this bug would be big if the attacker constructs a malicious data which would cause the service down. The code which causes the issue is in com.alibaba.fastjson.parser.JSONLexerBase#scanString, when a JSON string is passed in, fastjson would parse the string character by character, when it finds the \x, it would try to process the following two characters automatically an...

Coding is an very important part of programmer's daily work. But beyond coding, programmers need to do other work as well, they need to fix bugs reported by users, they need to write documents for their codes. Also, they often need to answer questions from customers, bosses and colleagues. What do they often say when they are facing different sort of questions? Today we share some.It's done. I just need to clean up a few things.This is hacky, but I'll fix it soon.This can never happen:It's just a one-line change so it shouldn't affect anything else. This task will be easy.Yeah, I tested it. I'...

Recently a serious security vulnerability was found in MySQL/MariaDB. It relates to the access to the database. The issue is described below.When a user connects to MariaDB/MySQL, a token (SHA over a password and a random scramble string) is calculated and compared with the expected value. Because of incorrect casting, it might've happened that the token and the expected value were considered equal, even if the memcmp() returned a non-zero value. In this case MySQL/MariaDB would think that the password is correct, even while it is not.  Because the protocol uses random strings, the probab...

On Wednesday(2012-05-02), a remote code execution vulnerability in PHP was accidentally exposed to the Web, prompting fears that it may be used to target vulnerable websites on a massive scale. The bug itself was traced back to 2004, and came to light during a recent CTF competition.A CERT advisory on the flaw explains: “When PHP is used in a CGI-based setup (such as Apache's mod_cgid), the php-cgi receives a processed query string parameter as command line arguments which allows command-line switches, such as -s, -d or -c to be passed to the php-cgi binary, which can be exploited to dis...

I have been programming for a number of years already. I have seen others introduce bugs, and I have also introduced (and solved!) many bugs while coding. Off-by-one, buffer-overflow, treating pointers as pointees, different behaviors or the same function (this is specially true for cross-platform applications), race conditions, deadlocks, threading issues. I think I have seen quite a few of the typical issues.Yet recently I lost a lot of time to what I would call the most stupid C bug in my career so far, and probably ever.I am porting a Unix-only application which uses tmpfile() to create te...

There is a huge bug when Group Messaging is disabled in iOS 5. I'm shocked Apple hasn't fixed this yet.Today a friend sent out a text message blast, announcing they got a new phone number. Shortly after, I got text messages from three random people I don't know. I was confused how these people got my number, but then I realized they were replies intended for my friend who sent out the text blast.If you've ever used the Group Messaging feature, it's supposed to thread messages sent to groups, showing the person's name above their reply. But in order to use this...