Re: Removing dead code (was: Retrospective by 'gpg.fail' authors)
oss-security discussion cites DejaGnu's removed test-timeout feature as a rare case where dead code removal had security implications.
Jacob Bachmeyer posted to the oss-security mailing list a counterexample to arguments for routinely removing dead code, drawn from DejaGnu, a Tcl-based software testing framework. A Tcl variable 'testcnt' could be set to the expected number of test results to catch tests that failed to run to completion, illustrating how seemingly dead code can carry security-relevant behavior. The post is part of a broader retrospective discussion by the 'gpg.fail' authors.
- DejaGnu executes arbitrary code from trusted testsuites, limiting its attack surface by design
- A 'testcnt' Tcl variable once detected tests failing to run to completion
- Post argues dead code removal can occasionally eliminate security-relevant behavior
Posted by Jacob Bachmeyer on Sep 17 I actually have a very rare counterexample to that, from DejaGnu. DejaGnu is a software testing framework, and more-or-less cannot have security issues by definition, as its purpose is to execute arbitrary code from trusted testsuites. DejaGnu once "had" a feature that was supposed to catch tests that failed to run to completion. A Tcl variable, "testcnt" could be set to the expected number of test results. However,...
This source does not provide full text. Read it at seclists.org.