From owner-freebsd-security Thu Apr 19 14:13:53 2001 Delivered-To: freebsd-security@freebsd.org Received: from khavrinen.lcs.mit.edu (khavrinen.lcs.mit.edu [18.24.4.193]) by hub.freebsd.org (Postfix) with ESMTP id 9C2AF37B43C for ; Thu, 19 Apr 2001 14:13:40 -0700 (PDT) (envelope-from wollman@khavrinen.lcs.mit.edu) Received: (from wollman@localhost) by khavrinen.lcs.mit.edu (8.9.3/8.9.3) id RAA40978; Thu, 19 Apr 2001 17:13:31 -0400 (EDT) (envelope-from wollman) Date: Thu, 19 Apr 2001 17:13:31 -0400 (EDT) From: Garrett Wollman Message-Id: <200104192113.RAA40978@khavrinen.lcs.mit.edu> To: "D. K." Cc: security@FreeBSD.ORG, freebsd-standards@bostonradio.org Subject: Re: FreeBSD grow bug In-Reply-To: <3ADF5442.BD703D6@homepage.ru> References: <3ADF4DD0.17AB0F64@homepage.ru> <200104192042.QAA40625@khavrinen.lcs.mit.edu> <3ADF5442.BD703D6@homepage.ru> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org < said: > You are not right To quote from the Austin Group draft 6: The format can contain either numbered argument conversion specifications (that is, "%n$" and "*m$"), or unnumbered argument conversion specifications (that is, % and *), but not ^^^^^^^ both. The only exception to this is that %% can be mixed with ^^^^^ the "%n$" form. The results of mixing numbered and unnumbered argument specifications in a format string are undefined. When numbered argument specifications are used, specifying the Nth ^^^^^^^^^^^^^^^^^^ argument requires that all the leading arguments, from the ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ first to the (N-1)th, are specified in the format string. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The exact same language, spread out over several paragraphs, appears in the Single UNIX Spec version 2. -GAWollman To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message