From owner-cvs-usrbin  Sun Jul 14 10:23:35 1996
Return-Path: owner-cvs-usrbin
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id KAA07604
          for cvs-usrbin-outgoing; Sun, 14 Jul 1996 10:23:35 -0700 (PDT)
Received: from precipice.shockwave.com (ppp-5-22.rdcy01.pacbell.net [206.170.5.22])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id KAA07589;
          Sun, 14 Jul 1996 10:23:31 -0700 (PDT)
Received: from shockwave.com (localhost.shockwave.com [127.0.0.1]) by precipice.shockwave.com (8.7.5/8.7.3) with ESMTP id KAA07409; Sun, 14 Jul 1996 10:22:33 -0700 (PDT)
Message-Id: <199607141722.KAA07409@precipice.shockwave.com>
To: Wolfram Schneider <wosch@cs.tu-berlin.de>
cc: Nate Williams <nate@freefall.freebsd.org>,
        CVS-committers@freefall.freebsd.org, cvs-all@freefall.freebsd.org,
        cvs-usrbin@freefall.freebsd.org
Subject: Re: cvs commit: src/usr.bin/rdist defs.h docmd.c expand.c lookup.c server.c 
In-reply-to: Your message of "Sun, 14 Jul 1996 16:02:17 +0200."
             <199607141402.QAA00547@campa.panke.de> 
Date: Sun, 14 Jul 1996 10:22:32 -0700
From: Paul Traina <pst@shockwave.com>
Sender: owner-cvs-usrbin@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

That's way over-board.  The only case where sprintf can get you into trouble
is if you're sprintfing tainted variables (to steal a perl term) into a stack
buffer.

  From: Wolfram Schneider <wosch@cs.tu-berlin.de>
  Subject: cvs commit:  src/usr.bin/rdist defs.h docmd.c expand.c lookup.c serv
>>er.c
  Nate Williams writes:
  >nate        96/07/11 21:00:17
  >
  >  Modified:    usr.bin/rdist  defs.h docmd.c expand.c lookup.c server.c
  >  Log:
  >  Changed all sprintf() calls to snprintf().
  >  
  >  Obtained from:	Christos Zoulas <christos@deshaw.com> via NetBSD PR 262
>>1,
  >  
  >  [ slightly modified since we don't use libcompat anymore. ]
  >  
  >  I'm not sure if this fixes the rdist security bug completely, but it
  >  sure can't hurt!
  
  Should we disable sprintf() for sgid/suid programs?
  
  find /bin  /usr/bin /sbin /usr/sbin /usr/libexec -perm -u+s \
  	-o -perm -g+s |xargs egrep -l sprintf | wc -l
  
  47