[sagarm]

Yeah, agreed that a competent C++ dev would not write the code in the example. The charitable interpretation though is that errors of the same type can crop in real codebases, the example is just simplified for the purposes of discussion.

[pornel]

In such examples you’re always primed to look for a mistake. It’s a different situation when you have 100K+ lines of code, a dozen developers, and a deadline.

It’s a difference between “look this is Wally” (duh, of course) and a game of “Where’s Wally?”.

Whenever a CVE is discussed people say that the error is obvious, and no good programmer would write like that. It’s easy in hindsight.