On 4/26/16, 14:03 , "openssl-dev on behalf of Salz, Rich via RT" <openssl-dev-boun...@openssl.org on behalf of r...@openssl.org> wrote:
>That code is still wrong. Once you "get0" something you can only look at >it. You cannot pass it off to a "set0" function. Get0 gives you a >pointer that *you do not own* and *set0* takes a pointer that you DO own >and are giving away. On the other hand, it seems all to easy (IMHO) for a programmer to think “I got it from OpenSSL, and I’m passing it back…" >You can't give away something that isn't yours :) Funny, most of the governments I know of do this quite successfully and at quite a large scale. For a long time too. :) >The error is thinking that "my_e" is yours; it's not. As documented. Look. If Doug noticed this, programmers less intimate with this API are much more likely to get stung by it. The protection against such a misunderstanding is cheap. There is no justification for refusing to put this defense in. Insulate the wires instead of saying “I told him not to touch those wires”.
smime.p7s
Description: S/MIME cryptographic signature
-- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
