Date: Thu, 07 Sep 2000 16:46:55 -0600 From: Warner Losh <imp@village.org> Cc: Kris Kennaway <kris@FreeBSD.org>, "Todd C. Miller" <Todd.Miller@courtesan.com>, "Vladimir Mencl, MK, susSED" <mencl@nenya.ms.mff.cuni.cz>, freebsd-security@FreeBSD.org, security-officer@FreeBSD.org, millert@openbsd.org Subject: Re: UNIX locale format string vulnerability (fwd) Message-ID: <200009072246.QAA07311@harmony.village.org> In-Reply-To: Your message of "Thu, 07 Sep 2000 16:34:17 MDT." <200009072234.QAA07199@harmony.village.org> References: <200009072234.QAA07199@harmony.village.org> <Pine.BSF.4.21.0009071532190.25298-100000@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <200009072234.QAA07199@harmony.village.org> Warner Losh writes:
: : setlocale(), not catopen(). It is treated on the same footing as all of
: : the others, there.
:
: Ah, it shouldn't :-)
Index: setlocale.c
===================================================================
RCS file: /home/imp/FreeBSD/CVS/src/lib/libc/locale/setlocale.c,v
retrieving revision 1.27
diff -u -r1.27 setlocale.c
--- setlocale.c 2000/09/04 03:43:24 1.27
+++ setlocale.c 2000/09/07 22:34:42
@@ -129,7 +129,7 @@
if (!env || !*env)
env = getenv("LANG");
- if (!env || !*env)
+ if (!env || !*env || strchr(env, '/'))
env = "C";
(void) strncpy(new_categories[category], env, ENCODING_LEN);
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200009072246.QAA07311>