Date: Thu, 19 Apr 2001 16:42:40 -0400 (EDT) From: Garrett Wollman <wollman@khavrinen.lcs.mit.edu> To: "D. K." <dk@homepage.ru> Cc: security@FreeBSD.ORG Subject: FreeBSD grow bug Message-ID: <200104192042.QAA40625@khavrinen.lcs.mit.edu> In-Reply-To: <3ADF4DD0.17AB0F64@homepage.ru> References: <3ADF4DD0.17AB0F64@homepage.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
<<On Fri, 20 Apr 2001 00:42:56 +0400, "D. K." <dk@homepage.ru> said:
> int main(int argc, char *argv) {
> printf("%7$x\n", 1, 2, 3, 4, 5, 6, 7);
> printf("%8$x\n", 1, 2, 3, 4, 5, 6, 7, 8);
> printf("no grow bug\n");
> return 0;
> }
This code is erroneous. If the format string does not reference all
positional arguments up to and including the numerically greatest one
named, the result of *printf() is undefined. This is not a security
matter; replies to <freebsd-standards@bostonradio.org>, please.
-GAWollman
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200104192042.QAA40625>