LWN.net Logo

In 2011?

In 2011?

Posted Feb 8, 2012 3:11 UTC (Wed) by IkeTo (subscriber, #2122)
In reply to: In 2011? by iabervon
Parent article: Format string vulnerabilities

Format string with character not controlled by the application is universally bad. I think it is more reasonable to vsnprintf the application-supplied information to a fixed sized buffer, and printf the result with the user-supplied argv[0] with a fixed fmt. This limits the length of the output to the buffer size, but that is probably good for a log file anyway. The double-copy speed overhead is probably irrelevant.


(Log in to post comments)

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds