Informix

Informix

Connect with Db2, Informix, Netezza, open source, and other data experts to gain value from your data, share insights, and solve problems.

 View Only
Expand all | Collapse all

Detecting an exploited bug in 4GL Code

  • 1.  Detecting an exploited bug in 4GL Code

    Posted 09/23/24 05:05 PM
    One of our clients is in a quandary as to how to determine where a compiler bug was exploited in about 2million lines of 4GL (their count... I haven't checked)
    Apparently there was a bug in Informix 4GL 7.50.FC5 whereby, under very unique circumstances, evaluation of a null value against a variable resulted in a false return value. 
    Consider the following code where  myvar is null:
    if  not(myvar  =  10) then
        let answer = "Not 10"
    else
       let answer = "It is 10"
    end if
    The expected result from this statement is that answer contains the text "It is 10" because evaluations against null is neither true nor false  and therefore the else branch is chosen. Weirdly, if you add just one unused variable to the code, it is enough to change the compilation process such that the "It is 10" branch is taken which is the right evaluation. So, it is random in that it may or may not evaluate correctly.
    The client has shown me one application compiled using 7.50.FC5 where the above evaluated to "Not 10". This is/was a bug and resolved in subsequent versions (it cannot be reproduced in 7.51.fc3) which is great BUT the application inadvertently depended on the bug!
    Whilst the client appreciates that they were inadvertently exploiting a bug, the question now is how to sift through all their code and check if the bug was exploited elsewhere. I can't think of much myself except some fancy greps etc looking through the code for negated conditional statement. 
    I look forward to your comments 
    Thanks


    ------------------------------
    Andrew Cilia
    ------------------------------


  • 2.  RE: Detecting an exploited bug in 4GL Code
    Best Answer

    Posted 09/23/24 06:27 PM

    Because 4GL is a stack based language, bugs like this one are usually caused by an undefined value for a declared but uninitialized variable. A very similar bug existed in 4gl v7.30 that was fixed in v7.32. Code that worked in v7.30 broke in v7.32 as well as in Aubit4GL, Genero, and Lycia which properly complained about the uninitialized variable. 

    So, start by looking for variables that have been declared but not initialized.

    An awk script to index variables as they are declared and mark them once initialized, and at the end print out any not marked as initialized. 

    Art



    ------------------------------
    Art S. Kagel, President and Principal Consultant
    ASK Database Management Corp.
    www.askdbmgt.com
    ------------------------------



  • 3.  RE: Detecting an exploited bug in 4GL Code

    Posted 10/01/24 02:31 AM

    Art,

    You wrote that Four Js Genero has/had the same bug.

    Can you prove this?

    Is it about expressions evaluation or about variable initialization?

    The Genero runtime system always initializes variables.

    See this:

    sf@toro:/tmp$ cat xx.4gl
    MAIN
        DEFINE myvar INTEGER
        DISPLAY "myvar = ", myvar
        IF NOT(myvar = 10) THEN
           DISPLAY "Not 10"
        ELSE
           DISPLAY "It is 10"
        END IF
    END MAIN

    sf@toro:/tmp$ fglcomp -Wall xx.4gl && fglrun xx.42m
    myvar =           0
    Not 10

    As Reuben stated, Genero offers different tools to inspect the .4gl code.

    The easiest way to detect coding errors with Genero is to specify the -Wall option, that can be used in conjunction with -Werror to stop compilation on warnings.

    sf@toro:/tmp$ cat xx.4gl
    MAIN
        DEFINE myvar INTEGER
        DEFINE unused INTEGER
        DISPLAY "myvar = ", myvar
        IF NOT(myvar = 10) THEN
           DISPLAY "Not 10"
        ELSE
           DISPLAY "It is 10"
        END IF
    END MAIN

    sf@toro:/tmp$ fglcomp -M -Wall -Werror xx.4gl && fglrun xx.42m
    xx.4gl:3:12:3:17:error:(-6615) The symbol 'unused' is unused.


    Seb



    ------------------------------
    Sebastien FLAESCH
    ------------------------------



  • 4.  RE: Detecting an exploited bug in 4GL Code

    Posted 10/01/24 07:34 AM
    Sebastien:

    No bug in Genero, that was the "problem". There was an initialization bug. However, all of the 4GL "clone" superset languages did the initialization correctly, while 4GL had a bug that broke some code when it was fixed in classic 4GL later and so affected folks porting to Genero, Lycia, and Aubit4GL. This was well over 10 years ago anyway (as I said it was a bug in v7.30 that was fixed on v7.32).

    Art

    Art S. Kagel, President and Principal Consultant
    ASK Database Management


    Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference.  Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves.








  • 5.  RE: Detecting an exploited bug in 4GL Code

    Posted 10/01/24 07:41 AM

    Thanks for the clarification, Art.

    Sorry if I misunderstood your first reply.

    BTW it appears that Informix RDS initializes variables:

    sf@toro:/tmp$ fglpc -V
    IBM INFORMIX-4GL Version 7.51.FC1    
    Pcode Version 732-750

    Software Serial Number RDS#N000000
    sf@toro:/tmp$ fglpc xx.4gl
    sf@toro:/tmp$ fglgo xx.4go
    myvar =           0
    Not 10

    Seb



    ------------------------------
    Sebastien FLAESCH
    ------------------------------



  • 6.  RE: Detecting an exploited bug in 4GL Code

    Posted 10/01/24 07:49 AM
    Sebastien:

    It might be that R4GL didn't have that old bug either. Don't remember, but obviously stack handling and data initialization is going to be different in a pcode language versus one compiled to machine code.

    Art

    Art S. Kagel, President and Principal Consultant
    ASK Database Management


    Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference.  Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves.








  • 7.  RE: Detecting an exploited bug in 4GL Code

    Posted 10/01/24 08:17 AM
    Hi Art,
      going back to your recommendation to use awk to log definitions and initializations, would there be any sample code anywhere to start me off?  
    I'm pretty much out of my depths here because, to my mind, we need to break down the 4GL code by function/procedure and within each, check for definitions and related initializations.  
    Either way, thank you for your help thus far. 
    Cheers


    ------------------------------
    Andrew Cilia
    ------------------------------



  • 8.  RE: Detecting an exploited bug in 4GL Code

    Posted 10/01/24 09:21 AM

    Andrew:

    Very rudimentary, but here's a first cut:

    awk '

          /DEFINE|define/{vars[$2]=0;}
          /INITIALIZE/{vars[$2]=1;}
          END{ for( var in vars ) {
                if (vars[var] == 0){print "Variable " var " not initialized!";}}
          }'  some_code.4gl

    It won't deal with multiple variables defined in a single statement. That's a problem if the statement is multi-line since 4GL doesn't have a statement terminator.

    $ awk '/DEFINE|define/{vars[$2]=0;}/INITIALIZE/{vars[$2]=1;}END{ for( var in vars ) { if (vars[var] == 0){print "Variable " var " not i
    nitialized!";}}}' box_funcs.4gl
    Variable script not initialized!
    Variable x not initialized!
    Variable y not initialized!
    Variable warntext not initialized!
    Variable ret not initialized!
    Variable x, not initialized!

    Art



    ------------------------------
    Art S. Kagel, President and Principal Consultant
    ASK Database Management Corp.
    www.askdbmgt.com
    ------------------------------



  • 9.  RE: Detecting an exploited bug in 4GL Code

    Posted 10/01/24 09:27 AM

    Lovely.

    Thanks again  Art. 



    ------------------------------
    Andrew Cilia
    ------------------------------



  • 10.  RE: Detecting an exploited bug in 4GL Code

    Posted 10/01/24 11:22 AM

    I do not know what bug we are referring to. It would  be nice to point it out in order to help us all since we still have some clients that use old versions.

    From what I see is that there is confusion between Pseudo-code flavors of 4GL (GENERO and Informix RDS) and compiled versions of Informix 4GL.

    All of the Informix 4GL RDS versions even the old ones intialized all of the variables: INTEGER, SMALLINT, DECIMAL, FLOAT, CHAR (X) to 0 for INTEGER and SMALLINT, 0.0 for FLOAT and spaces for CHAR. That is not the case for the compiled versions of 4GL since a DEFINE is just a declaration of an address in memory. If you do a DISPLAY of defines variables in a compield 4GL program, the contents displayed are just whatever was in memory at those locations in memory at execution time; it is basically junk. That is why we always advice to initialize all of the variables to be cleaner and avoid wrong results and allow the portability to RDS if desired. GENERO is in the same case as RDS since the code is not compiled but of p-code nature.

    Just compile a small 4GL compiled version and generate the C version of the code. Look at the C code and you will see that variables are not initialized. Some C compilers have options to initialize variables if desired. We noticed that sometimes moving C code from AIX to LINUX provoques different behaviors since the compilers do not work the same way.

    Best way it to ALWAYS INITIALIZE variables to avoid issues in relation with the contents of variables.

    Cordialement, Regards,    Khaled Bentebal Directeur Général - ConsultiX Tél: 33 (0) 1 39 12 18 00 Mobile: 33 (0) 6 07 78 41 97 Email: khaled.bentebal@consult-ix.fr Site Web:  www.consult-ix.fr
    Le 01/10/2024 à 13:34, Art Kagel via IBM TechXchange Community a écrit :
    0100019247dc0a68-2a8596f1-ccb3-4295-8728-1e681caa42f6-000000@email.amazonses.com">
    Sebastien: No bug in Genero, that was the "problem". There was an initialization bug. However, all of the 4GL "clone" superset languages did the...





  • 11.  RE: Detecting an exploited bug in 4GL Code

    Posted 10/14/24 05:59 PM

    Please be aware that in IBM 4gl you can use the c4gl -initvar to have all declared variables initialized just like they are in r4gl(RDS).  I believe this option is missing from the manual but is shown when you run c4gl -help.

    Additionally, you can use the c4gl -anyerr to catch unusual errors that might get skipped over.  Just be aware that it changes the status variable which can be an issue when there is an operation between a sql command and the test of status for the sql result.



    ------------------------------
    Daniel Karwatka
    ------------------------------



  • 12.  RE: Detecting an exploited bug in 4GL Code

    Posted 10/15/24 05:59 AM

    Thanks Daniel,

        we'll give this a try

    Cheers



    ------------------------------
    Andrew Cilia
    ------------------------------



  • 13.  RE: Detecting an exploited bug in 4GL Code

    Posted 10/15/24 05:58 AM

    Hi Khaled,

         yes I agree that I didn't state that the client is using C4GL. Sorry about that. Genero doesn't really come into it but was referenced in this discussion to point out that, like versions of R4GL, variables are initialized at compilation. 

    As far as the bug reference of this issue goes, I wouldn't be able to point that out. It was fixed somewhere between 7.50.FC5 and 7.51.FC3. Either way, it was one of the more renown issues. Re. your recommendations, always initializing is definitely paramount but the issue now is how to find where variables are not initialized in (let's say) hundrends of thousand of lines of code.

    I've seen some of the recommendations from other posts (thanks by the way to you all. ... much appreciated) which we will be trying out. 



    ------------------------------
    Andrew Cilia
    ------------------------------



  • 14.  RE: Detecting an exploited bug in 4GL Code

    Posted 09/30/24 09:23 AM

    If I faced the problem with Four Js Genero, I would look to tackle using the Abstract Syntax Tree we can generate.  Might take some trial and error but essentially looking at the first child of IF nodes and looking to see if it is a NOT node or a descendant is. 

    Reuben



    ------------------------------
    Reuben Barclay
    ------------------------------