From owner-freebsd-audit Tue Aug 14 14: 7:40 2001 Delivered-To: freebsd-audit@freebsd.org Received: from meow.lab.nuxi.com (meow.lab.nuxi.com [66.123.5.2]) by hub.freebsd.org (Postfix) with ESMTP id E667337B401; Tue, 14 Aug 2001 14:07:33 -0700 (PDT) (envelope-from sethk@meow.lab.nuxi.com) Received: (from sethk@localhost) by meow.lab.nuxi.com (8.11.4/8.11.2) id f7EL6xV17547; Tue, 14 Aug 2001 14:06:59 -0700 (PDT) (envelope-from sethk) Date: Tue, 14 Aug 2001 14:06:59 -0700 From: Seth Kingsley To: Kris Kennaway Cc: obrien@FreeBSD.ORG, audit@FreeBSD.ORG Subject: Re: WFORMAT=1 errors Message-ID: <20010814140659.C12506@meow.lab.nuxi.com> References: <20010810182125.A47936@xor.obsecurity.org> <20010810194150.A71696@meow.lab.nuxi.com> <20010810202002.A49763@xor.obsecurity.org> <20010813174001.B33585@meow.lab.nuxi.com> <20010814024026.A36283@xor.obsecurity.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="1ccMZA6j1vT5UqiK" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20010814024026.A36283@xor.obsecurity.org>; from kris@obsecurity.org on Tue, Aug 14, 2001 at 02:40:27AM -0700 Organization: Wind River Systems X-Operating-System: FreeBSD 4.3-STABLE i386 X-GPG-Key-ID: 1024D/5C413B08 X-GPG-Key-Fingerprint: F772 5D24 02B4 D233 90F5 080F 0F50 3298 5C41 3B08 Sender: owner-freebsd-audit@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG --1ccMZA6j1vT5UqiK Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Aug 14, 2001 at 02:40:27AM -0700, Kris Kennaway wrote: > Make it a const char fmt[]. gcc doesn't complain if you repoint fmt > to something else if it's a const char * -- that something else can be > variable input and therefore potentially insecure: Ahh, right you are, the const qualifier can be granted later through a function call. > [...] >=20 > (Note: no variable format string warning, and we get extra warnings if > we try and repoint it anyway). My problem with this is that the strings can not always be declared as character arrays. In the usr.bin/make case in fact, the format strings are kept in a structure that defines how different command syntaxes for different shells get passed as arguments to them. struct shell_desc { const char *echo_fmt; }; static struct shell_desc sh_desc =3D {"echo \"%s\""}; sprintf(cmd, sh_desc, echo_str); Is there any way around this? --=20 || Seth Kingsley || Platforms Lab Opps || seth.kingsley@windriver.com || --1ccMZA6j1vT5UqiK Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE7eZLzD1AymFxBOwgRAk5QAJ9InaAacQ+ZAKVcNhsdEPqoYR+wdwCePB4A ZOTsimOWRXTnyrKhPpUNcVg= =OiB9 -----END PGP SIGNATURE----- --1ccMZA6j1vT5UqiK-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-audit" in the body of the message