From: Brandon Casey <casey@nrlssc.navy.mil>
Date: Mon, 10 Nov 2008 19:47:55 GMT
Subject: Re: [PATCH] Fixed non-literal format in printf-style calls
Message-ID: <3t9bmcAj9kThyafdZ9mPENosknipZInn9Qq9u9oVuN7X7qwiI4GqZg@cipher.nrlssc.navy.mil>
In-Reply-To: <1226344517-16120-1-git-send-email-dlowe@bitmuse.com>

Daniel Lowe wrote:

<snip>

>  }
> diff --git a/grep.c b/grep.c
> index e2c190a..1db60d9 100644
> --- a/grep.c
> +++ b/grep.c
> @@ -514,7 +514,7 @@ static int grep_buffer_1(struct grep_opt *opt, const char *name,
>  				if (from <= last_shown)
>  					from = last_shown + 1;
>  				if (last_shown && from != last_shown + 1)
> -					printf(hunk_mark);
> +					printf("%s", hunk_mark);

Perhaps these should by changed to use fputs() instead.

<snip>

> diff --git a/path.c b/path.c
> index eb24017..ae2c724 100644
> --- a/path.c
> +++ b/path.c
> @@ -41,7 +41,7 @@ char *mksnpath(char *buf, size_t n, const char *fmt, ...)
>  	len = vsnprintf(buf, n, fmt, args);
>  	va_end(args);
>  	if (len >= n) {
> -		snprintf(buf, n, bad_path);
> +		snprintf(buf, n, "%s", bad_path);

and these should use strlcpy.

-brandon