CodeSOD: Going on a teDa

Carlos G found some C++ that caused him psychic harm, and wanted to know how it ended up that way. So he combed through the history. Let’s retrace the path with him.

Here was the original code:

<span class="hljs-function"><span class="hljs-type">void</span> <span class="hljs-title">parseExpiryDate</span> <span class="hljs-params">(<span class="hljs-type">const</span> <span class="hljs-type">char</span>* expiryDate)</span>
</span>{
    <span class="hljs-comment">// expiryDate is in "YYMM" format</span>
    <span class="hljs-type">int</span> year, month;
    <span class="hljs-built_in">sscanf</span>(expiryDate, <span class="hljs-string">"%2d%2d"</span>, &year, &month);
	
    <span class="hljs-comment">//...</span>
}

This code takes a string containing an expiry date, and parses it out. The sscanf function is given a format string describing two, two digit integers, and it stores those values into the year and month variables.

But oops! The expiry date is actually in a MMYY format. How on earth could we possibly fix this? It can’t be as simple as just swapping the year and month variables in the sscanf call, can it? (It is.) No, it couldn’t be that easy. (It is.) I can’t imagine how we would solve this problem. (Just swap them!)

<span class="hljs-function"><span class="hljs-type">void</span> <span class="hljs-title">parseExpiryDate</span><span class="hljs-params">(<span class="hljs-type">const</span> <span class="hljs-type">char</span>* expiryDate)</span>
</span>{
    <span class="hljs-comment">// expiryDate is in "YYMM" format but, in some part of the code, it is formatted to "MMYY"</span>
    <span class="hljs-type">int</span> year, month;	 
    <span class="hljs-type">char</span> correctFormat[<span class="hljs-number">5</span>];

    correctFormat[<span class="hljs-number">0</span>] = expiryDate[<span class="hljs-number">2</span>];
    correctFormat[<span class="hljs-number">1</span>] = expiryDate[<span class="hljs-number">3</span>];
    correctFormat[<span class="hljs-number">2</span>] = expiryDate[<span class="hljs-number">0</span>];
    correctFormat[<span class="hljs-number">3</span>] = expiryDate[<span class="hljs-number">1</span>];
    correctFormat[<span class="hljs-number">4</span>] = <span class="hljs-string">''</span>;
    <span class="hljs-built_in">sscanf</span>(correctFormat, <span class="hljs-string">"%2d%2d"</span>, &year, &month);

    <span class="hljs-comment">//...</span>
}

There we go! That was easy! We just go, character by character, and shift the order around and copy it to a new string, so that we format it in YYMM.

The comment here is a wonderful attempt at CYA. By the time this function is called, the input is in MMYY, so that’s the relevant piece of information to have in the comment. But the developer really truly believed that YYMM was the original input, and thus shifts blame for the original version of this function to “some part of the code” which is shifting the format around on them, thus justifying… this trainwreck.

Carlos replaced it with:

<span class="hljs-function"><span class="hljs-type">void</span> <span class="hljs-title">parseExpiryDate</span> <span class="hljs-params">(<span class="hljs-type">const</span> <span class="hljs-type">char</span>* expiryDate)</span>
</span>{
    <span class="hljs-comment">// expiryDate is in "MMYY" format</span>
    <span class="hljs-type">int</span> month, year;
    <span class="hljs-built_in">sscanf</span>(expiryDate, <span class="hljs-string">"%2d%2d"</span>, &month, &year);
	
    <span class="hljs-comment">//...</span>
}

[Advertisement]
Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.Learn more.

Source: Read More