Re: Removing dead code (was: Retrospective by 'gpg.fail' authors)
oss-security discussion cites DejaGnu's removed test-timeout feature as a rare case where dead code removal had security implications.
Jacob Bachmeyer posted to the oss-security mailing list a counterexample to arguments for routinely removing dead code, drawn from DejaGnu, a Tcl-based software testing framework. A Tcl variable 'testcnt' could be set to the expected number of test results to catch tests that failed to run to completion, illustrating how seemingly dead code can carry security-relevant behavior. The post is part of a broader retrospective discussion by the 'gpg.fail' authors.
- DejaGnu executes arbitrary code from trusted testsuites, limiting its attack surface by design
- A 'testcnt' Tcl variable once detected tests failing to run to completion
- Post argues dead code removal can occasionally eliminate security-relevant behavior
- Products
- DejaGnu
- Organizations
- oss-securitygpg.fail
From the original article
Posted by Jacob Bachmeyer on Sep 17 I actually have a very rare counterexample to that, from DejaGnu. DejaGnu is a software testing framework, and more-or-less cannot have security issues by definition, as its purpose is to execute arbitrary code from trusted testsuites. DejaGnu once "had" a feature that was supposed to catch tests that failed to run to completion.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.