In 2011?

In 2011?

Posted Feb 3, 2012 5:27 UTC (Fri) by geofft (subscriber, #59789)
In reply to: In 2011? by NAR
Parent article: Format string vulnerabilities

The subtlety here is that the sudo code wanted to prefix the application's name to the message, and the message came from an arbitrary format. So you have code which looks very much like the following pseudocode:

sudo_debug(char *fmt, ...) {
    char *real_fmt = asprintf("%s: %s", argv[0], fmt);
    printf(real_fmt, ...);
}

It's actually not the strangest thing in the world to pass a non-constant argument to the printf format. For instance, the following would be totally reasonable:

sudo_debug(char *fmt, ...) {
    char *real_fmt = asprintf("sudo: %s", argv[0], fmt);
    printf(real_fmt, ...);
}

---

(Log in to post comments)