Mailing-List: contact dev-help@openoffice.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@openoffice.apache.org
To: dev@openoffice.apache.org
From: Patricia Shanahan <pats@acm.org>
Subject: A refactoring proposal
Message-ID: <6b051c98-f366-00dc-ba8e-17f64e212eba@acm.org>
Date: Sat, 17 Jun 2017 10:52:21 -0700
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.2.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
archived-at: Sat, 17 Jun 2017 17:52:35 -0000

Without going into details here, some recently fixed security issues
have related to the use of fixed size arrays without bounds checks.

In general, that is not a very robust programming practice. It depends
on careful checking in the source code to prevent array overflow.

I suggest a project to replace raw arrays with Standard Template Library
classes as appropriate. All accesses should be through safe functions
such as std::array::at. In some cases we could replace a limited size
but large array with e.g. a std::vector that can start small and grow
only as needed.

This matches nicely with my observations of volunteers. We are not
getting many people with the skills and experience to dive into a
very large body of code and debug it. We are getting students and
early career programmers who could work on something like this. It
might also be a viable Google Summer of Code project.


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org