Apple wrote bugged TLS code that broke using unbraced ifs with a goto, hence the name "goto fail". You don't need a goto to break this code though. All you need is a second indented line under the if
#2 is also the most insideous to update. Add another indented line to one of the conditions and the cotrol flow completely breaks while visually appearing fine.
C and a number of other languages have annoying pair of parallel syntax systems that makes it easy for people to read code one way and computers to compile it another. People read the indentation and newlines while compilers count braces and semicolons. #2 gets rid of the braces and makes control flow driven by semicolons making human visual inspection more likely to fail