Re: sprintf security holes?

From: Morten Welinder <mwelinder@gmail.com>
Date: Sep 16, 2005, 16:11 UTC
Message-ID: <118833cc05091609111fd4d2d8@mail.gmail.com>
In-Reply-To: <86zmqd5aey.fsf@blue.stonehenge.com>

> Since sprintf() can lead to buffer overflows from unprotected user
> data, and you want to use git in server situtations, wouldn't it be
> prudent to eliminate those in some near-ish timeframe?

I assume you mean make them into snprintf calls.

I don't think that really buys you anything, i.e., there would still be far too many places where character pointers are derefenced and assigned to. You would probably have to create a small (and thus auditable) generic strings library and do all string creation within that. That is certainly feasible, but evidently not Linus style.

There really is nothing wrong with sprintf that couldn't be said to be wrong with snprintf, strcpy, strncpy, *p++ = 0, etc. If you don't have the right amount of memory allocated, you lose. (Yes, that goes for the "n" versions too, although in many cases you could syntactically check that a "sizeof" was used. Then you just get to worry whether random truncation introduced other security problems.)

Morten