Re: Guile bugs

[Marko Rauhamaa]

address@hidden (Ludovic Courtès):

> I don’t know to what extent that is applicable to your software, but my
> recommendation would be to treat that network socket as a Scheme port,
> pass it to ‘read’, and pass the result to ‘eval’ (as opposed to reading
> the whole string from C++ and passing it to ‘scm_eval_string’.)

Octet stream sockets break the stream at arbitrary locations. Eval isn't
going to like it if you blindly hand bytes over to it. You first need to
break the stream into complete S-expressions. Note also that the socket
might not even respect UTF-8 boundaries so you can't assume you can read
the bytes as text.

Secondly, this lucrative pattern can be very dangerous as it allows
arbitrary code to be executed at the peer end. In most applications, it
is better to interpret the S-expressions explicitly.


Marko