An unintentional-looking but crash-causing bug

19

4

There are a range of questions revolving around this concept, but these all seem to just involve causing a crash, resulting in many answers which are very obviously designed to cause a crash. So the challenge I set you is to write some plausible code (although what the codes supposed "intention" is I leave up to you), that crashes either the entire target OS, or just itself, in a way which is not immediately obvious. (I realize that what counts as "immediately obvious" is subjective, but hopefully the challenge is still reasonably clear).

The winner is the answer with the most votes after 5 days.

w4etwetewtwet

Posted 2013-12-29T19:24:44.343

Reputation: 349

Question was closed 2016-04-18T16:01:33.190

1

I'm voting to close this question as off-topic because underhanded challenges are no longer on-topic on this site. http://meta.codegolf.stackexchange.com/a/8326/20469

– cat – 2016-04-18T14:47:36.487

Removed tag code-challenge since there is no objective criterion given. – Howard – 2014-01-02T20:52:06.967

2There have been too many occurrences of these in my actual code. I can't remember any of them, though. – Joe Z. – 2014-01-10T16:47:05.860

Related: the Underhanded C Contest has a bunch of problems with a similar goal, and some quite clever solutions to them.

– FireFly – 2014-01-13T14:29:29.453

Answers

30

C, linux. Crashes system if run as root

/* Fork child process, wait 5 seconds and kill it */
pid_t pid = fork();
if(pid =! 0) {
    /* Parent */
    sleep(5);
    kill(pid, 11);
}
else {
    /* Child process. Would contain some code */
}

By changing != to =!, an innocent comparison is turned into an assignment. And given that pid 1 is init, and killing init causes a kernel panic, this is not code you would want to run as root :)

Dennis Kaarsemaker

Posted 2013-12-29T19:24:44.343

Reputation: 1 194

1init ignores SIGKILL, to kernal panic you must send it SIGSEGV, signal 11 – MultiplyByZer0 – 2013-12-29T23:08:49.767

1Ah, rats. Edited to change, but that makes it a lot less inconspicuous. Would SIGTERM work too? – Dennis Kaarsemaker – 2013-12-29T23:13:58.600

1

No: http://unix.stackexchange.com/questions/7441/can-root-kill-init-process

– MultiplyByZer0 – 2013-12-29T23:14:51.480

3I would hide SIGSEGV by using numeric code. After all, it could've been a mistake. – Konrad Borowski – 2014-01-02T21:56:39.697

I like that idea, edited :) – Dennis Kaarsemaker – 2014-01-02T22:35:04.337

I have been away and haven't looked at this question for a few days, sorry for accepting it late. – w4etwetewtwet – 2014-01-11T09:46:11.290

27

C#

Let's just initialize a list of bytes with every byte value from 0 to 255.

List<byte> bytes = new List<byte>();
for (byte i = 0; i <= 255; i++)
{
    bytes.Add(i);
}

Out of memory? I distinctly recall having more than 256 bytes installed...

Spoiler:

A byte will always be less than or equal to 255. Addition wraps around from 255 to 0.

Kendall Frey

Posted 2013-12-29T19:24:44.343

Reputation: 2 384

3This took me longer than it should've to figure out – Hannesh – 2014-01-02T20:57:16.733

Doesn't the C# compiler warn you that you're pbzcnevat jvgu n pbafgnag gung'f bhg bs obhaqf? (rot13'd to not spoil the riddle) – Dennis Kaarsemaker – 2014-01-02T22:38:45.840

@Dennis probably not, because lbh pna pbzcner qvssrerag ahzrevp glcrf jvgubhg reebe/jneavat, naq gur pbafgnag va dhrfgvba vf n inyvq vag. – wchargin – 2014-01-02T22:44:43.707

2@DennisKaarsemaker It does warn you if lbh hfr 'yrff-guna gjb svsgl fvk' which is why I didn't do that. There are no warnings here though. – Kendall Frey – 2014-01-03T00:24:28.507

ah, yes, that makes sense. – Dennis Kaarsemaker – 2014-01-03T00:31:46.263

I'm still having trouble working out why this works, so I think it fulfills its purpose well! – w4etwetewtwet – 2014-01-03T10:01:38.133

2Here's a decode/encoder str.toLowerCase().split('').map(function(c) { return c < 'a' || c > 'z' ? c : String.fromCharCode(((c.charCodeAt(0) - 'a'.charCodeAt(0) + 13) % 26) + 'a'.charCodeAt(0)); }).join('') – MosheK – 2014-01-10T17:26:54.097

@handuel, I had problems too ;__; The point is, that jura v=255 gura arkg ybbc vgrengvba znxrf v=0 (orpnhfr bs olgr glcr). Guhf ybbc arire raqf (nyjnlf v<=255) naq nqqf vasvavgr pbhag bs olgrf gb gur yvfg (rot13.com) – wasyl – 2014-01-13T13:58:30.933

Here's another encoder/decoder: vi i<m-V><esc>g??:qa<return> – Hovercouch – 2014-01-15T01:00:38.583

7

C

#include <stdio.h>

int main(void) {
   fputs(stdout, "Hello, world!\n");
   return 0;
}

(Compiler warnings will give it away.)

Nate Eldredge

Posted 2013-12-29T19:24:44.343

Reputation: 2 544

3

JavaScript

var arr = [3,6,1,54,2,-4,8,10,3,7]
function qs(a) {
    if (a.length < 2) return a
    var part = a.shift()
    var higher = [], lower = []
    for (var i = 0; i < a.length; i ++) {
        var x = a[i] // *** THIS LINE ***
        (x < part ? lower : higher).push(x)
 }
    return qs(lower).concat([part]).concat(qs(higher))
}
alert(qs(arr))

Working quicksort, except for the fact that lack of semicolon on the line I marked with a comment causes it to parse wrong and crash.

Adding a semicolon at the end of that line fixes it.

Doorknob

Posted 2013-12-29T19:24:44.343

Reputation: 68 138

0

C++

Inputs names and store them in a vector. Prints names upon entry of flag value. Asks if user thought of more names; if so, inputs names.

#include <iostream>
#include <string>
#include <vector>
using namespace std;

void print(const vector<string>& v) {

  for (int i = 0; i <= names.size(); i++)
    cout << v[i] << endl;
}

void input(vector<string>& v) {

  string tmp;

  cout << "Enter a list of names seperated by returns: ";

  do {
    getline(cin, tmp);

    if (tmp != "-1")
      v.push_back(tmp);

  } while (tmp != "-1");

  print(v);
}

int main() {

  vector<string> names;

  string tmp;

  do {
    input(names);

    cout << "Do you have any more names to input (y or n)? ";
    cin >> tmp;

  } while (tmp == "y");

  return 0;
}

For non-C++, Java, C users, the error is in print()s for statement. It should be for (int i = 0; i < names.size(); i++). This is an easy error to make and overlook (until you get the compiler message) because it is only 1 character and because the >= operator is sometimes required in for loops.

user10766

Posted 2013-12-29T19:24:44.343

Reputation:

Dunno, spotted it right at the beginning of reading. Maybe would be better to put print() somewhere later in code, so that the reader would get a bit tired before coming to the mistake :) – Ruslan – 2014-06-23T14:02:26.123

0

GTB

:""→_[_+"+"→_]

Crashes the calculator because [_+ should be ["_"+, but since it isn't, the calculator runs out of memory, potentially clearing the RAM in the wrong way.

Timtech

Posted 2013-12-29T19:24:44.343

Reputation: 12 038

3["_"+ looks like a face that's a little upset with me – corsiKa – 2014-01-13T18:14:07.920