Subject: Re: DIAGASSERT in cryptographic functions.
To: Bill Sommerfeld <sommerfeld@orchard.arlington.ma.us>
From: Jason Thorpe <thorpej@nas.nasa.gov>
List: tech-userlevel
Date: 09/16/1999 11:07:12
On Thu, 16 Sep 1999 12:43:52 -0400 
 Bill Sommerfeld <sommerfeld@orchard.arlington.ma.us> wrote:

 > +#ifdef _DIAGNOSTIC
 > +       if (context == 0 || input == 0)
 > +               return;
 > +#endif
 > 
 > in md5c.c::MD5Final(), which may cause the function to silently return a
 > potentially erroneous value to its caller.

EEEP!

 > I think the whole "try to keep running in the face of detected errors"
 > aspect of the _DIAGASSERT/_DIAGNOSTIC changes is ill-advised; the
 > #ifdef _DIAGNOSTIC/if (...)  return;/#endif blocks should be deleted,
 > and _DIAGASSERT should be changed to cause a fatal exception rather
 > than merely a warning.

I most certainly agree.  What we need is printf-to-stderr-and-dump-core
semantics.

        -- Jason R. Thorpe <thorpej@nas.nasa.gov>