User: Password:
|
|
Subscribe / Log in / New account

In 2011?

In 2011?

Posted Feb 2, 2012 16:27 UTC (Thu) by NAR (subscriber, #1313)
Parent article: Format string vulnerabilities

I always thought that just as we no longer use gets() in C code, nobody would write printf(variable). I mean it's kind of reflex to write printf("", ), then fill the rest of the stuff.


(Log in to post comments)

In 2011?

Posted Feb 2, 2012 22:11 UTC (Thu) by iabervon (subscriber, #722) [Link]

Nobody does write printf(variable). Unfortunately, they do write vprintf(fmt, args), where fmt is the concatenation of some strings and an appropriate format string. The goals were: call a single stdio function in order to avoid interleaving your message with other output (potentially from a subprocess); print a bit of identifying information at the beginning; and print a caller-supplied format string with its appropriate arguments. There's not really a good way to do all of these together, since you can't insert things in a va_list.

In 2011?

Posted Feb 8, 2012 3:11 UTC (Wed) by IkeTo (subscriber, #2122) [Link]

Format string with character not controlled by the application is universally bad. I think it is more reasonable to vsnprintf the application-supplied information to a fixed sized buffer, and printf the result with the user-supplied argv[0] with a fixed fmt. This limits the length of the output to the buffer size, but that is probably good for a log file anyway. The double-copy speed overhead is probably irrelevant.

In 2011?

Posted Feb 3, 2012 5:27 UTC (Fri) by geofft (subscriber, #59789) [Link]

The subtlety here is that the sudo code wanted to prefix the application's name to the message, and the message came from an arbitrary format. So you have code which looks very much like the following pseudocode:
sudo_debug(char *fmt, ...) {
    char *real_fmt = asprintf("%s: %s", argv[0], fmt);
    printf(real_fmt, ...);
}
It's actually not the strangest thing in the world to pass a non-constant argument to the printf format. For instance, the following would be totally reasonable:
sudo_debug(char *fmt, ...) {
    char *real_fmt = asprintf("sudo: %s", argv[0], fmt);
    printf(real_fmt, ...);
}

In 2011?

Posted Feb 3, 2012 12:42 UTC (Fri) by NAR (subscriber, #1313) [Link]

If the format string comes from (potentially untrusted) source, then we're screwed anyway, that has to be verified along with the arguments. And probably that is the right time to generate the output string too (at least the parts coming from the user).


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds