Winners of the 7th Underhanded C Contest

by vezzy-fnord • 11 years ago

318 44 11 years ago

Is it possible to view all the entries with no explanation? I want to try to spot the problems.

masklinn3• 11 years ago

They don't seem available anywhere, maybe try to contact UnderhandedC@gmail.com and ask if they could release the entries?

jimrandomh2• 11 years ago

Yeah, that really spoiled the fun for me. I wanted to read through and see if I could spot the tricks myself, but it keeps giving the answers before even showing the code that the trick is in!

chii• 11 years ago

haha, the winning entry is pure genius! It was so difficult to follow, and the code that produces the bug is only viewable if you examined the macro expanded source code - and the macro used _all_ look like functions, so a casual code reviewer probably won't recall them being macros in the first place.

masklinn3• 11 years ago

and the macro used _all_ look like functions

AUDIT properly looks like a macro, which makes it even more likely a reviewer wouldn't notice __isleap is one as well.

emiliobumachar• 11 years ago

They did it backwards this year. A run-of-the-mill evil program that unexpectedly does something heroic.

masklinn3• 11 years ago

Is that really backwards? The contest is "underhanded", not evil. Underhandedness can be used for good or evil, and it is good that this year's contest reminds entrant of that.

pavel_lishin• 11 years ago

Sure, but it's explicitly defined as the Evil part.

M2Ys4U• 11 years ago

From the view of the 'Security' Services it's evil. For everybody else it isn't.

dbbolton• 11 years ago

The PiuPiu oversharing site allows users to create PiuPiu accounts and post 140-character messages.

Hah- "Piu-Piu" is the Brazilian-Portuguese name for the Looney Tunes character Tweety:

https://pt.wikipedia.org/wiki/Piu-piu

https://en.wikipedia.org/wiki/Tweety

andrepd• 11 years ago

Yes, and "piu" is the Portuguese onomatopoeia for "tweet".

lamuerteflaca• 11 years ago

And in Spanish it is "pio" for tweet. Very close to the portuguese one.

jimrandomh2• 11 years ago

SPOILERS. If you want to see if you can spot the tricks, do not look at this page; it only contains solutions, it doesn't contain the programs themselves!

guelo• 11 years ago

I'm not a C programmer so I'm wondering, don't the common C editors highlight macros and functions differently?

nothrabannosir• 11 years ago

I have personally never come across this. Moreover, "common" C editors are vanilla vim and emacs, which don't actually know what's a macro and what's a function without customization (ctags &c).

Good idea, though. I'd like it.

nitrogen2• 11 years ago

Some slightly less common IDE-based ones can, like Eclipse, and probably Kdevelop, QtCreator, and MSVC.

There are likely to be add-ons for Vim and Emacs that actually parse the source instead of just pattern matching for syntax highlighting.

GFK_of_xmaspast2• 11 years ago

With emacs, this actually an ideological choice.

mrpopo• 11 years ago

Yes, all decent C/C++ IDEs (Eclipse, Visual Studio, CodeBlocks) use different syntax highlighting for macros and functions. The problem with nested macros like this is a common bad programming practice, highlighted here in the C/C++ FAQ : https://isocpp.org/wiki/faq/inline-functions#inline-vs-macro...

Someone• 11 years ago

To do that you need to do quite a bit of what the compiler does. For example, you need to know the include search paths, which can get modified by compiler flags, and you need to know what flags got set on the command line, for example to discriminate debug from release builds or to specify C99 compliance.

So, you basically need an IDE to do robust C syntax coloring.

rikrassen• 11 years ago

I'd also imagine that since the contest is framed as getting around code reviews the code would be inspected using some other source code display tool. These tools certainly wouldn't do any kind of context-sensitive reasoning.

kayamon3• 11 years ago

I'm kinda annoyed that the judge completely misread my entry. I had it so that data was leaked out of a function that could not possibly leak data, via a malloc side-channel attack (ala HeartBleed).

Instead it got judged as being a 'simple buffer overflow'.

Grrr.

nitrogen2• 11 years ago

I'd call that a win. Even the judge was fooled.

kayamon3• 11 years ago

I'll post up my complete entry in case anyone's interested to look through it:

http://www.codersnotes.com/files/piupiu.zip

See surveil.txt for notes first.

Someone below asked what makes this different from the Obfuscated C contest. In this contest, the idea is to make code that looks very clean and innocent. Entries that hide their behavior in weird ugly macros or just general C complexity are not really in the spirit of the contest. I tried to make my entry very clean so that there is obviously no malicious code anywhere in it.

rcthompson2• 11 years ago

Do the judges get to read your explanation before deciding the results, or do they just have to decide based on the code?

kayamon3• 11 years ago

I sent an explanation with it, no idea if anyone read it or not.

umanwizard• 11 years ago

Edited to remove spoiler.

sylvinus• 11 years ago

Incredible mix of evil and genius, congrats to the winners. I'm still astounded at how many obscure ways there are in C to fool a code reviewer.

Definitely makes me feel less safe considering the amount of C code there is in tools we depend on.

m3talridl3y• 11 years ago

I'm glad to see that there are more women's names this year - including the winner. A sign of better representation in tech in the future?

nickpsecurity• 11 years ago

Or just more interested in our field of digital sorcery. Either way, I agree it's good to see more women in these things. Having different types of people makes things more interesting. And often more surprising. :)

egillie• 11 years ago

How is this different from the Obfuscated C contest? http://www.ioccc.org/

euid• 11 years ago

In this contest, you are to intentionally insert a difficult-to-detect bug into otherwise legible code. In the obfuscated C contest, you are writing obfuscated code.

https://en.wikipedia.org/wiki/Obfuscation_%28software%29

ctdonath• 11 years ago

Speaking of which, anyone knows why the IOCCC results are stalled? Winners were announced but winning source code not yet released.

roscopcoltrane• 11 years ago

Why is it underhanded to let a user know that his government is censoring/surveiling his posts? This should be the freedom-c contest.

rcthompson2• 11 years ago

It's underhanded in that the function should look like it's doing one thing but also do another hidden task as well.

9872• 11 years ago

Why is it underhanded to let out people whose government has locked them in cages? Sounds like freedom to me. Now where's the nearest maximum security prison...

shiggerino2• 11 years ago

Why someone would use this language for a real project is beyond me.

S4M• 11 years ago

A real project like writing a Kernel or implementing a programming language?

shiggerino2• 11 years ago

Yes, real projects like that. Or projects like OpenSSL.

Winners of the 7th Underhanded C Contest

Related Stories