Summary

bb egg may error out with format security issue

Metadata

Attachments

Description

As found at http://parenteses.org/mario/misc/salmonella-2011-10-13/install/bb.html

newer gcc detects a format string security problem -- essentially the result of doing printf(foo); instead of printf("%s", foo).

Attached patch should fix problem. It is untested. Keeping this assigned to myself until I can test the patch works as intended.

Changes and comments

[2011-10-14 00:38:25 UTC] zbigniew attached bb-fmt-sec.diff (description=#f)

[2011-10-14 01:26:31 UTC] zbigniew changed status from new to assigned

[2011-10-14 01:26:31 UTC] zbigniew changed owner from zbigniew to felix

[2011-10-14 01:26:31 UTC] zbigniew wrote:

Patch is good. I tested it with:

 (bb:message "Hi %d")
 (bb:message 'message "Hi %d")
 (bb:message 'alert "Hi %d")
 (bb:message 'ask "Hi %d")
 (bb:message 'choice "Word? %d" "foo" "bar" "baz")
 (bb:get-input "Enter a string %d:" "Default value")

and on the old version you'll get a garbage number displayed, on the new one you get a literal %d.

Patch also fixes use of fl_ask where fl_choice was meant.

Feel free to apply if looks okay, or I will be happy to apply myself.

[2011-10-28 09:19:15 UTC] felix changed status from assigned to closed

[2011-10-28 09:19:15 UTC] felix set resolution to fixed

[2011-10-28 09:19:15 UTC] felix wrote:

Thanks - tagged a new version, 1.30.