User: Password:
|
|
Subscribe / Log in / New account

In 2011?

In 2011?

Posted Feb 3, 2012 5:27 UTC (Fri) by geofft (subscriber, #59789)
In reply to: In 2011? by NAR
Parent article: Format string vulnerabilities

The subtlety here is that the sudo code wanted to prefix the application's name to the message, and the message came from an arbitrary format. So you have code which looks very much like the following pseudocode:

sudo_debug(char *fmt, ...) {
    char *real_fmt = asprintf("%s: %s", argv[0], fmt);
    printf(real_fmt, ...);
}
It's actually not the strangest thing in the world to pass a non-constant argument to the printf format. For instance, the following would be totally reasonable:
sudo_debug(char *fmt, ...) {
    char *real_fmt = asprintf("sudo: %s", argv[0], fmt);
    printf(real_fmt, ...);
}


(Log in to post comments)

In 2011?

Posted Feb 3, 2012 12:42 UTC (Fri) by NAR (subscriber, #1313) [Link]

If the format string comes from (potentially untrusted) source, then we're screwed anyway, that has to be verified along with the arguments. And probably that is the right time to generate the output string too (at least the parts coming from the user).


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds