[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201010121711.44451.oeriksson@mandriva.com>
Date: Tue, 12 Oct 2010 17:11:44 +0200
From: Oden Eriksson <oeriksson@...driva.com>
To: oss-security@...ts.openwall.com
Subject: Re: Nagios format string issues
torsdag 07 oktober 2010 10:55:49 skrev Tomas Hoger:
> On Wed, 6 Oct 2010 21:56:09 +0200 Oden Eriksson wrote:
> > I just extracted the patches I made at the time. I cannot tell which
> > of them deserves CVE assignments though. I have put them here:
> >
> > http://n1.nux.se/work/format_not_a_string_literal_and_no_format_arguments
> > /
>
> Did you use any specific way to identify all these? From a quick look
> at a few randomly chosen patches, there seem to be cases where one call
> was fixed, other left unchanged. That's only for the code visible in
> the context diff.
This was discovered when we started using -Wformat -Werror=format-security
> There are few incorrect fixes too:
>
> - g_snprintf (gev.data.b, sizeof (gev.data.b), message);
> + g_snprintf (gev.data.b, sizeof (gev.data.b), message, "%s");
Whoops!
--
Regards // Oden Eriksson
Security team manager - Mandriva
CEO NUX AB
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
