[11743] in bugtraq
Re: ProFTPD 1.2.0pre4 available
daemon@ATHENA.MIT.EDU (Ben Pfaff)
Wed Sep 8 11:26:49 1999
Message-Id: <87g10vfrl6.fsf@pfaffben.user.msu.edu>
Date: Fri, 3 Sep 1999 20:28:05 -0400
Reply-To: pfaffben@msu.edu
From: Ben Pfaff <pfaffben@MSU.EDU>
X-To: BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: Werner Koch's message of "Wed, 1 Sep 1999 09:51:10 +0200"
Werner Koch <wk@ISIL.D.SHUTTLE.DE> writes:
Malicious User <mark@NIJNTJE.NET> writes:
> knock it around. I suspect this version will still fail on FreeBSD
> (anyone care to offer up an account for me on a FreeBSD system to test
Instead of using snprintf() you can you sprintf() and change the
"%s" formats to (e.g.) "$%.30s" - somewhat more work but much more
portable.
Note that snprintf() is in the C9x draft standard, so it will soon be
much more common that it is today. As a result, it may not be worth
it to try to be more portable through such devices.
In addition, it is worth noting that snprintf() as specified by the
C9x draft has return value semantics different from those commonly
found. As a result, calls to snprintf() where the return value is
checked should be scrutinized, since this change could presumably pose
a security risk.
To cite one place where this changes, glibc 2.1 uses the C9x return
value semantics, whereas glibc 2.0 uses the older semantics.
--
"You know, they probably have special dorms for people like us."
--American Pie
