git/list[1] front-page[2] threads[3] people[4] search[5] about
 

sprintf security holes?

From
Randal L. Schwartz <merlyn@stonehenge.com>
Date
Sep 16, 2005, 14:56 UTC
Message-ID
<86zmqd5aey.fsf@blue.stonehenge.com>

As I was trying to (unsuccessfully) compile git for OpenBSD, I noticed a number of occurances of sprintf(), because OpenBSD thoughtfully yells at programmers for using that.

Since sprintf() can lead to buffer overflows from unprotected user data, and you want to use git in server situtations, wouldn't it be prudent to eliminate those in some near-ish timeframe?

-- 
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn@stonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!
Next: Morten Welinder
Message 1 of 5 in “sprintf security holes?”
  1. Randal L. SchwartzSep 16, 2005
  2. Morten WelinderSep 16, 2005
  3. [Was Re: sprintf security holes?] Building on OpenBSDPeter Eriksen, Sep 16, 2005
  4. Junio C HamanoSep 19, 2005
  5. Sven VerdoolaegeSep 19, 2005

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.