From: Randal L. Schwartz <merlyn@stonehenge.com>
Date: Fri, 16 Sep 2005 14:56:05 GMT
Subject: sprintf security holes?
Message-ID: <86zmqd5aey.fsf@blue.stonehenge.com>


As I was trying to (unsuccessfully) compile git for OpenBSD, I noticed
a number of occurances of sprintf(), because OpenBSD thoughtfully
yells at programmers for using that.

Since sprintf() can lead to buffer overflows from unprotected user
data, and you want to use git in server situtations, wouldn't it be
prudent to eliminate those in some near-ish timeframe?

-- 
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn@stonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!