DEV Community

forqx
forqx

Posted on

Apple's "goto fail" was one duplicated line. Would you have caught it in review?

#codereview #security #programming #career

In February 2014 Apple shipped an SSL bug that let attackers intercept supposedly-secure traffic on iOS and macOS. The patch, when it came, was essentially a one-line deletion. Here is the famous fragment from Apple's published source:


if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0)
    goto fail;
if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
    goto fail;
    goto fail;
if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)
    goto fail;
Enter fullscreen mode Exit fullscreen mode

The indentation is lying to you. The second goto fail; lines up as if it belongs to the if above it, but C without braces attaches only the first statement to the condition. The duplicated line runs unconditionally, jumps to the cleanup label with err still 0, and the signature verification below never executes. Every connection "verified" successfully.

No compiler error. Tests passed, because the happy path was genuinely happy. The code even looks reviewed: it is neat, consistent, follows the file's style. The bug is not in what the code does, it is in what it skips.

Why this bug aged well

Twelve years later this exact shape is back, for a new reason. AI assistants generate guard-clause code all day: early returns, validation chains, cleanup jumps. The code is always tidy. The failure mode is the same as Apple's: a control-flow path that silently bypasses the one check that mattered, in a diff that reads perfectly line by line.

Reviewing that kind of code is a skill of its own. You are not asking "is each line correct", you are asking "which paths reach the sensitive operation without going through the check". Line-by-line reading does not surface it; path-thinking does.

Try it on a modern version

I rebuilt the goto-fail pattern as a Node webhook verifier and put it into DiffDojo, a trainer I am building where you review realistic AI-generated PRs, leave inline comments, give a verdict, and find out whether you caught the planted bug.

The goto-fail-shaped one is here: webhook signature verification challenge. No signup needed, free during early access.

If you want the honest experience: do not go in knowing "it is the goto fail bug". Open the library, pick a few at random, and see how your eye does when nobody tells you there is a bug at all. Some of the PRs are clean, because saying "this is fine" with confidence is also part of the job.

What is the closest you have come to shipping a goto fail of your own?

Top comments (0)