Lovely.
Original Message:
Sent: Tue October 01, 2024 09:21 AM
From: Art Kagel
Subject: Detecting an exploited bug in 4GL Code
Andrew:
Very rudimentary, but here's a first cut:
awk '
/DEFINE|define/{vars[$2]=0;}
/INITIALIZE/{vars[$2]=1;}
END{ for( var in vars ) {
if (vars[var] == 0){print "Variable " var " not initialized!";}}
}' some_code.4gl
It won't deal with multiple variables defined in a single statement. That's a problem if the statement is multi-line since 4GL doesn't have a statement terminator.
$ awk '/DEFINE|define/{vars[$2]=0;}/INITIALIZE/{vars[$2]=1;}END{ for( var in vars ) { if (vars[var] == 0){print "Variable " var " not i
nitialized!";}}}' box_funcs.4gl
Variable script not initialized!
Variable x not initialized!
Variable y not initialized!
Variable warntext not initialized!
Variable ret not initialized!
Variable x, not initialized!
Art
------------------------------
Art S. Kagel, President and Principal Consultant
ASK Database Management Corp.
www.askdbmgt.com
------------------------------
Original Message:
Sent: Tue October 01, 2024 08:16 AM
From: Andrew Cilia
Subject: Detecting an exploited bug in 4GL Code
Hi Art,
going back to your recommendation to use awk to log definitions and initializations, would there be any sample code anywhere to start me off?
I'm pretty much out of my depths here because, to my mind, we need to break down the 4GL code by function/procedure and within each, check for definitions and related initializations.
Either way, thank you for your help thus far.
Cheers
------------------------------
Andrew Cilia
Original Message:
Sent: Tue October 01, 2024 07:48 AM
From: Art Kagel
Subject: Detecting an exploited bug in 4GL Code
Sebastien:
It might be that R4GL didn't have that old bug either. Don't remember, but obviously stack handling and data initialization is going to be different in a pcode language versus one compiled to machine code.
Art
Art S. Kagel, President and Principal Consultant
ASK Database Management
Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves.
Original Message:
Sent: 10/1/2024 7:41:00 AM
From: Sebastien FLAESCH
Subject: RE: Detecting an exploited bug in 4GL Code
Thanks for the clarification, Art.
Sorry if I misunderstood your first reply.
BTW it appears that Informix RDS initializes variables:
sf@toro:/tmp$ fglpc -V
IBM INFORMIX-4GL Version 7.51.FC1
Pcode Version 732-750
Software Serial Number RDS#N000000
sf@toro:/tmp$ fglpc xx.4gl
sf@toro:/tmp$ fglgo xx.4go
myvar = 0
Not 10
Seb
------------------------------
Sebastien FLAESCH
Original Message:
Sent: Tue October 01, 2024 07:33 AM
From: Art Kagel
Subject: Detecting an exploited bug in 4GL Code
Sebastien:
No bug in Genero, that was the "problem". There was an initialization bug. However, all of the 4GL "clone" superset languages did the initialization correctly, while 4GL had a bug that broke some code when it was fixed in classic 4GL later and so affected folks porting to Genero, Lycia, and Aubit4GL. This was well over 10 years ago anyway (as I said it was a bug in v7.30 that was fixed on v7.32).
Art
Art S. Kagel, President and Principal Consultant
ASK Database Management
Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves.
Original Message:
Sent: 10/1/2024 2:31:00 AM
From: Sebastien FLAESCH
Subject: RE: Detecting an exploited bug in 4GL Code
Art,
You wrote that Four Js Genero has/had the same bug.
Can you prove this?
Is it about expressions evaluation or about variable initialization?
The Genero runtime system always initializes variables.
See this:
sf@toro:/tmp$ cat xx.4gl
MAIN
DEFINE myvar INTEGER
DISPLAY "myvar = ", myvar
IF NOT(myvar = 10) THEN
DISPLAY "Not 10"
ELSE
DISPLAY "It is 10"
END IF
END MAIN
sf@toro:/tmp$ fglcomp -Wall xx.4gl && fglrun xx.42m
myvar = 0
Not 10
As Reuben stated, Genero offers different tools to inspect the .4gl code.
The easiest way to detect coding errors with Genero is to specify the -Wall option, that can be used in conjunction with -Werror to stop compilation on warnings.
sf@toro:/tmp$ cat xx.4gl
MAIN
DEFINE myvar INTEGER
DEFINE unused INTEGER
DISPLAY "myvar = ", myvar
IF NOT(myvar = 10) THEN
DISPLAY "Not 10"
ELSE
DISPLAY "It is 10"
END IF
END MAIN
sf@toro:/tmp$ fglcomp -M -Wall -Werror xx.4gl && fglrun xx.42m
xx.4gl:3:12:3:17:error:(-6615) The symbol 'unused' is unused.
Seb
------------------------------
Sebastien FLAESCH
Original Message:
Sent: Mon September 23, 2024 06:26 PM
From: Art Kagel
Subject: Detecting an exploited bug in 4GL Code
Because 4GL is a stack based language, bugs like this one are usually caused by an undefined value for a declared but uninitialized variable. A very similar bug existed in 4gl v7.30 that was fixed in v7.32. Code that worked in v7.30 broke in v7.32 as well as in Aubit4GL, Genero, and Lycia which properly complained about the uninitialized variable.
So, start by looking for variables that have been declared but not initialized.
An awk script to index variables as they are declared and mark them once initialized, and at the end print out any not marked as initialized.
Art
------------------------------
Art S. Kagel, President and Principal Consultant
ASK Database Management Corp.
www.askdbmgt.com