Date: Tue, 13 Dec 2005 23:41:34 +1100 (EST) From: Bruce Evans <bde@zeta.org.au> To: Poul-Henning Kamp <phk@phk.freebsd.dk> Cc: Max Laier <max@love2party.net>, freebsd-arch@FreeBSD.org Subject: Re: printf behaviour with illegal or malformed format string Message-ID: <20051213230723.T3248@epsplex.bde.org> In-Reply-To: <9880.1134463229@critter.freebsd.dk> References: <9880.1134463229@critter.freebsd.dk>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 13 Dec 2005, Poul-Henning Kamp wrote: > In message <20051213175413.H80942@delplex.bde.org>, Bruce Evans writes: > >> There is also fmtcheck(3). > > I didn't even know about that one, but given that there is only two > uses in all of /src I do not feel ashamed. I learned about it commit mail (or arch?) when Kris was sweeping for security holes related to printf formats. >> Extensions should rarely be needed for printf(), > > Actually I disagree with you on that. > > It was my list of "things I keep doing over and over" that convinced > me otherwise. Now I think they should be very rarely needed and more rarely used. Using them mainly gives unportable code that breaks especially badly on systems which don't support extensions. > Here are some of the formats I miss, and which I will probably write > extensions for so people can trivially enable them: > > %T print a time_t > %lT print a struct timeval > %llT print a struct timespec > %I print an IP# > %lI print an IPv6# > %H Hexdump > %V stringvis a string > %M Metric (like the "engineering" format on HP calculators) > %H "Human" (Tera,Giga,Mega,Kilo{bits,bytes}) I think these belong in specialized applications or libraries. %T is already handled better by strftime/gmtime/localtime. It has lots of subformats and delicate conversion issues. A generic %T couldn't reasonably support much more than "%[#0- +,]*.*T". If a generic version were implemented as a function in libc, then printf("%T", asprintf_time_t(tt)) wouldn't be much harder to write than printf("%T", tt), but storage management for it would be harder. Maybe you really want to write cout << tt :-). >>>> I'm leaning towards doing what phkmalloc has migrated to over time: >>>> Make a variable which can select between "normal/paranoia" and force >>>> it to paranoia for (uid==0 || gid==0 || setuid || setgid). >>>> >>>> If the variable is set, a bogus format string will result in abort(2). >> >> This sometimes breaks defined behaviour. > > It does ? I didn't think there were defined behaviour for bogus > format strings ? I mean aborting instead of returning NULL for failing malloc()s breaks defined behaviour. Bruce
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051213230723.T3248>