<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Hum &#187; arithmetic</title>
	<atom:link href="http://blog.ronhsu.com/tag/arithmetic/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.ronhsu.com</link>
	<description>Atia of the Julii, I call for justice!</description>
	<lastBuildDate>Tue, 20 Jul 2010 06:15:26 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>Someone Exploited My Scoreboard</title>
		<link>http://blog.ronhsu.com/2009/08/17/someone-exploited-my-scoreboard/</link>
		<comments>http://blog.ronhsu.com/2009/08/17/someone-exploited-my-scoreboard/#comments</comments>
		<pubDate>Tue, 18 Aug 2009 07:46:49 +0000</pubDate>
		<dc:creator>Ron</dc:creator>
				<category><![CDATA[Software]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[apple]]></category>
		<category><![CDATA[arithmetic]]></category>
		<category><![CDATA[gem]]></category>
		<category><![CDATA[gem story]]></category>
		<category><![CDATA[integer]]></category>
		<category><![CDATA[iphone]]></category>
		<category><![CDATA[mac]]></category>
		<category><![CDATA[objective-c]]></category>
		<category><![CDATA[overflow]]></category>
		<category><![CDATA[story]]></category>
		<category><![CDATA[xcode]]></category>

		<guid isPermaLink="false">http://blog.ronhsu.com/?p=565</guid>
		<description><![CDATA[Someone managed to exploit a flaw in the way I calculate high scores for my game Gem Story. As of 8/18/09, Quest Name Score Level Date ma 2147483647 16 August 13 2009 Loren 1317023 28 August 16 2009 yan 1108697 9 August 04 2009 Matt 880118 20 August 06 2009 moogleii 313409 17 July 10 [...]]]></description>
			<content:encoded><![CDATA[<p>Someone managed to exploit a flaw in the way I calculate high scores for my game <a href="http://blog.ronhsu.com/2009/07/08/gem-story/">Gem Story</a>.</p>
<p>As of <a href="http://www.excari.com/gemstory/highscores.php">8/18/09</a>,</p>
<h2>Quest</h2>
<table border="0">
<tbody>
<tr>
<th>Name</th>
<th>Score</th>
<th>Level</th>
<th>Date</th>
</tr>
<tr>
<td>ma</td>
<td>2147483647</td>
<td>16</td>
<td>August 13 2009</td>
</tr>
<tr>
<td>Loren</td>
<td>1317023</td>
<td>28</td>
<td>August 16 2009</td>
</tr>
<tr>
<td>yan</td>
<td>1108697</td>
<td>9</td>
<td>August 04 2009</td>
</tr>
<tr>
<td>Matt</td>
<td>880118</td>
<td>20</td>
<td>August 06 2009</td>
</tr>
<tr>
<td>moogleii</td>
<td>313409</td>
<td>17</td>
<td>July 10 2009</td>
</tr>
<tr>
<td>smd</td>
<td>298247</td>
<td>1</td>
<td>July 08 2009</td>
</tr>
<tr>
<td>bud</td>
<td>284941</td>
<td>32</td>
<td>July 11 2009</td>
</tr>
<tr>
<td>Emily</td>
<td>242672</td>
<td>6</td>
<td>July 07 2009</td>
</tr>
<tr>
<td>hech</td>
<td>184688</td>
<td>8</td>
<td>July 15 2009</td>
</tr>
<tr>
<td>Gg</td>
<td>170662</td>
<td>13</td>
<td>August 05 2009</td>
</tr>
</tbody>
</table>
<p>I thought I had accounted for such a scenario with proper checks, but it looks like I made some false assumptions about how things are cast in Objective-C. Guess I should have read the documentation more thoroughly. I wonder if this is true with C as well. I admit, I haven&#8217;t coded in C in a long time.</p>
<p>Anyway, player &#8220;ma&#8221; got an exorbitant score as you can see. To computer science folks, his particular score number, 2147483647, should immediately pop out.  That happens to be the maximum value for a signed integer.  So I figured he must have lowered his score into the negative, and at some point, my program attempted to assign a negative value to a variable that only accepts positive values. When that happens, the number will wrap around to the other side. So assigning -1 to a positive-only variable will jump the number around to the highest value.</p>
<p>Anyway, as I said, I thought I had accounted for that, by doing something like:</p>
<p>if ( ( NSInteger ) score + ( pointValue * multiplier ) ) &gt; 0 )</p>
<p>but I guess that wasn&#8217;t enough. I did some testing (I&#8217;ve renamed some stuff to make it a little more readable):</p>
<ol>
<li>NSUInteger uStartValue = 0;</li>
<li>NSInteger sPointValue = -1000; //signed value</li>
<li>NSUInteger uMultiplier = 10; //unsigned value</li>
<li>NSInteger sMultiTest = sPointValue * uMultiplier; //-10000</li>
<li>BOOL test = NO;</li>
<li>test = (sPointValue * multiplier) &gt; 0; // YES&#8230;whut?</li>
<li>NSUInteger unsignedTest = (sPointValue * uMultiplier); //4294957296</li>
</ol>
<p>So this is interesting. So 7 shows the overflow in action. 6 seems to show that if a mixed-type operation isn&#8217;t assigned to a value, then it will default to type NSUInteger, if the operation contains an NSUInteger. But if you explicitly assign it, as in 4, then it&#8217;ll work fine.</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.ronhsu.com/2009/08/17/someone-exploited-my-scoreboard/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
