All entries were scored on a combination of Creativity, Code Believability and lastly count accuracy: because if the numbers look approximately right, it's harder to discover that they are indeed wrong by a few percent. All grades are out of 10 . Enjoy reading the source, and let me know if I missed some critical trickery of the program in my one sentence explanation of the failure.
Paul Parkanzky and Michal Zalewski are our two winners! Congratulations to all who participated, and apologies for the final announcement taking so many months.
Date Specific Programs
7.0 Paul Parkanzky: pparkanzky: Uses the fact that the string "second" has more words than "first" or "third" to cause a buffer overrun and skew results. Just gives them to Bush, not uninitialized memory like Matt Eastman.
7.0 Jasvir Nagra: jnagra: Uses the fact that the string "second" has more words than "first" or "third" and the fact that the times between 10 and 12am have 2 characters to cause a buffer overrun and skew results. Just gives them to Bush, not uninitialized memory like Matt Eastman. (Submitted past deadline, no victory)
6.7 Matthew Eastman: meastman: pointer arithmetic, stack smashing
6.0 Jamie Strachan: sov.cpp: Uses shell script to compile a file, run it, morphing it into another file to run and skew the votes.
5.6 Chris Ruppert: cruppert: pushes bush to nader after nov2 deadline by #defining a strange macro that inserts itself into a case statement. #defining break, a language keyword, is pretty giveaway that something is up.
5.3 Michal Forisek: mforisek: Clever political messages, uses #define to change "another number" to number instead of another_number ,when verifying that the number of votes don't exceed the number of registered voters. the call to time could have been hidden better.
5.0 Scott Craver: scraver: Local variable l gets assigned to 104 on the big day. When l is laterr used in place of 1 to multiply bush's count by 104.
4.3 Corey Edwards: cedwards: #define madness
3.3 David Wheeler: dwheeler5: Uses different code on election day.
Date Agnostic Programs
7.3 Michal Zalewski: mzalewski: Gives 1/10 of the votes to bush. Relies on macro pasting to alter the apparent meaning of code (suddenly locally declared t hides t in the outer scope)
6.3 Kennisth Davis: kdavis: printf returns 0 or 1 depending on debug, so if debug is turned on it returns correct values, other moves values there.
6.0 Michael Moore: mmoore: Comments obfuscate ?: statement that blocks out index.
6.0 Jean-Philippe Martin: jmartin: query-replace 1 l where l==-1, buffer overrun
5.7 Kester Maddock: kmaddock: Arrays begin at 0, not 1; hence uninitialized memory for the initial bush tally.
5.7 Fredrick Oehrstroemfoehrstroem: misparenthesized #define statement causes ! to cancel out with !BUSH and makes it only true if !!BUSH==input
5.7 Adam Barth: abarth: #define, Order of Operations
5.7 Travis Fisher:tfisher:macro madness... replaces the unsigned char Vote with a crazy expression that does some vote skewing (this is done on the gcc command line). Unfortunately since the exact command line was lost to the sands of time, this one will need to suffice gcc -Disspace="'K'==" macro_tfisher.c
5.3 John Waymouth: jwaymouth: Exploits the fact that order in which arguments are evaluated is undefined in C++ (postincrement in call to doTally)
5.3 Matthew T Russotto: mrussotto: Uninitialized other variable could cause the map from char to int to point to zero for the 'Other' category
5.3 David Mazieres: dmazieres: local macro variable c hides the outer c. Pasting causes this variable to be shadowed.
5.0 Rachel ParkeHouben: rparke: Utilizes the fact that constructed order matters. Produces a warning in gcc
5.0 Joshua Hudson: jhudson: Passes in the number of bytes read instead of the byte read, while obscuriing it with setjmp and other nasties.
5.0 Ryan Cumings: rcumings: Modulus operator '%' forces all votes to go to table rows 0 or 1 in lines 130-144. Unrelated, complex code to hide a simple O vs 0 swap.
4.3 Robert A Seace: rseace: Casts from ulong* to uchar* and then accesses it. Also issues a warning in gcc with appropriate options.
4.0 Henrik Abelsson: habelsson: #defines to gotos! Considered harmful.
4.0 Eric Noyau: enoyau: Uses l instead of 1
4.0 Geir Thomassen: gthomassen: #define of EOF to changing input to bush using comma operator.
4.0 David Wheeler: dwheeler: no break after Other case.
3.7 Craig A Rich: crich: Hides a Tally[] = 0 in a comment. Only works on notepad users.
3.7 Thiago Campos: tcampos: uses wrong ascii value in part of program. Teaches the value of constants in code.
3.7 Jared Sohn: jsohn: Typo in nader section checking if Vote is 'n' or 'n' instead of 'n' or 'N': votes delivered to Other. Guess its' writein. Creative alternative comments.
3.7 Philip Willoughby: pwilloughby: Replaces 1 with l
3.7 Oleg Kibirev: okibirev: uses l instead of 1 when adding to bush's tally. (this is what the ++ operator is for ;-) )
3.7 Hacksprint: hacksprint: Replaces 1 with l
3.7 Alan Krueger: akrueger: Replaces 1 with l
3.7 Kristian Nielsenknielsen: puts the kerry case in a while statement that looks for spaces.
3.3 Derek Warnickdwarnick: Zero instead of O in the code gives Other votes to Kerry
3.3 Matti Niemenmaa: mniemenmaa: = instead of ==
3.3 Drew Vogel: dvogel: bitwise and instead of logical and
3.3 Brad Grzesiak: bgrzesiak: gets instead of equals
3.0 Jonathan Drechsler: jdrechsler: Uses lower case 'k'
Further analysis of these results, and some discussion on how to counter them, can be found in Initial Analysis of Underhanded Source Code by David A. Wheeler, IDA Document D-13166, April 2020)