Object identifiers [modified]
-
Once upon a time, I was leading a team that was doing the server side of an internet banking application. Because this sort of app was in its infancy, there was little confidence, and a lot of paranoia. IIRC, the flow was that a connection would come into an external server, a session would be created and packed and sent across a serial cable to the machine that would handle authentication. This packet would be decrypted, verified and sent back, then it would move on to another machine across another serial cable for the transaction. We had essentially the same process running on each machine, but operating a bit differently depending on the role. ANYWAY ... we had a problem in that sometimes, a session would drop out, and the service would crash. We logged, we debugged, we stepped through, and couldn't find it, until one fine day, we hit a breakpoint, and the developer said "Huh. That's funny. That should be a session object, not a data chunk." The penny dropped. "Ah," I said. "That session ID that you're passing back and forth between machines ... is that an index into the session array, or what?" "No," came the bemused reply. "I thought it would be quicker to just use the address of the object". Apparently, the original object had been deleted because the session had been dropped, and the runtime had reused the space for something else. So when the session ID was cast from its session ID form (int) to its pointer form, it was pointing at something else. Don't get me wrong ... I love pointers. I just had no idea that their abuse would be extended to neighbouring machines. -- modified at 23:41 Monday 5th March, 2007
-- All things considered, you can't really consider all things ...