Best of Code Review 2015 - Exterminator category

Question

Please post your nominations for the Best of Code Review 2015 - Exterminator category.

Answer that points out the most interesting obscure bug in the original code.

In your nomination post, please make sure to include a link to the nominated answer, as well as a short explanation of what makes that post worthy of being nominated in this category, and why it should win over the others.

---

_{Small characters at the bottom: Only one nomination per post, nominated answers must have a creation date in 2015, downvotes don't count, and Santa reserves the right to award the top-voted nominee a special bounty as a token of appreciation on behalf of the Code Review community.}

Answer 1

This answer by Quuxplusone to "Hybrid Lock Implementation (C++)" points out a nearly invisibly typo that breaks the whole thing.

In the question, OP meant to write this->mFlag but wrote this>mFlag and of course, since in C++ this is just a pointer, everything compiles. That's one reason to avoid this-> qualifying member variables in C++, especially when they are integer types that can be compared with > ;)

Apart from that, the answer also gives a lot of other very good advices. Definitely a +1.

Answer 2

I guess I'm nominating my own here.

This answer I wrote was actually one I did not intend to write; it was actually pointed out to me by @200_success, probably due to the fact that I asked a question with code that had very similar functions.

The code was about a game where each player takes turns saying numbers. The number is then summed to the total. The player who says the number that sums the total to be greater than 21 (or greater than or equal to, in my case) loses. The code wrote an AI who was "guaranteed" to win, according to OP.

The bug? AI lost to me.

I pointed that out in my answer, and changed the given code by @200_success in his/her/its answer to fit OP's needs. This drastic change may also allow this to be eligible for the Night and Day category.

Answer 3

Login without Password because of PHPs weak typing

The code was quite short, and relatively simple:

if (strcmp($_GET["userpass"], $correctPassword) == 0) {
    login();
}

The problem here is that PHP is not very strict with typing. If an array is passed to strcmp, it returns NULL, and as we all know, NULL == 0 is true.

I like this example, as it shows why weak typing can easily lead to security issues (of course, generally passwords are hashed, so this problem would likely not occur in any secure code, but it still illustrates the point).

Answer 4

What happened to my good password?

This is another question which shows that proper knowledge of functions concerning security is important, and that it is not advisable to just pass all input to some generic security cleaning function.

Because a password is passed to strip_tags, a secure password such as a<super$secure!password would be converted to the much less secure a.

Answer 5

A sleep-deprived @DanPantry spotted a critical bug that I had missed, and wrote this answer to Follow up - Creating Inheritance hierarchy using function constructor.

Despite the fact that the question contained a "working" demo, it was actually completely broken, due to the accidental use of global variables in JavaScript. Ironically, the fancy inheritance hierarchy that was designed to manage complexity and avoid globals fell completely apart due to this subtle mistake.

Lessons reinforced:

• A working demo is not a demonstration of correctness
• 'use strict'; is an important habit