Date: Tue, 14 Aug 2001 14:06:59 -0700 From: Seth Kingsley <seth.kingsley@windriver.com> To: Kris Kennaway <kris@obsecurity.org> Cc: obrien@FreeBSD.ORG, audit@FreeBSD.ORG Subject: Re: WFORMAT=1 errors Message-ID: <20010814140659.C12506@meow.lab.nuxi.com> In-Reply-To: <20010814024026.A36283@xor.obsecurity.org>; from kris@obsecurity.org on Tue, Aug 14, 2001 at 02:40:27AM -0700 References: <20010810182125.A47936@xor.obsecurity.org> <20010810194150.A71696@meow.lab.nuxi.com> <20010810202002.A49763@xor.obsecurity.org> <20010813174001.B33585@meow.lab.nuxi.com> <20010814024026.A36283@xor.obsecurity.org>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --]
On Tue, Aug 14, 2001 at 02:40:27AM -0700, Kris Kennaway wrote:
> Make it a const char fmt[]. gcc doesn't complain if you repoint fmt
> to something else if it's a const char * -- that something else can be
> variable input and therefore potentially insecure:
Ahh, right you are, the const qualifier can be granted later through a
function call.
> [...]
>
> (Note: no variable format string warning, and we get extra warnings if
> we try and repoint it anyway).
My problem with this is that the strings can not always be declared as
character arrays. In the usr.bin/make case in fact, the format strings
are kept in a structure that defines how different command syntaxes for
different shells get passed as arguments to them.
struct shell_desc {
const char *echo_fmt;
};
static struct shell_desc sh_desc = {"echo \"%s\""};
sprintf(cmd, sh_desc, echo_str);
Is there any way around this?
--
|| Seth Kingsley || Platforms Lab Opps || seth.kingsley@windriver.com ||
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org
iD8DBQE7eZLzD1AymFxBOwgRAk5QAJ9InaAacQ+ZAKVcNhsdEPqoYR+wdwCePB4A
ZOTsimOWRXTnyrKhPpUNcVg=
=OiB9
-----END PGP SIGNATURE-----
home |
help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010814140659.C12506>