You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Brian Behlendorf <br...@organic.com> on 1997/01/24 09:29:26 UTC
sprintf still around...
There's still sprintf's in http_bprintf.c (Ben, do you think you could look at
this?), mod_include.c, util.c, and util_md5.c. Is it worth trying to fix these
before 1.2b5?
Brian
--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
brian@organic.com www.apache.org hyperreal.com http://www.organic.com/JOBS
Re: sprintf still around...
Posted by Brian Behlendorf <br...@organic.com>.
Cool cool cool. I'll add this to the to-be-written Apache Security FAQ I
suppose.
Brian
On Fri, 24 Jan 1997, Marc Slemko wrote:
> The stuff in bprintf I did not bother with because you need to understand
> what exactly it is doing and I did not have time. It is possible there
> are problems left there.
>
> Note the comment above the sprintf in mod_include; it needs to be there
> because ap_snprintf() doesn't do quads. It could almost certainly be
> changed to a snprintf(), since BSD version that have quad st_size's
> should have snprintf(), but it isn't worth the bother because it isn't
> a string.
>
> The one in util.c is similar, and is slightly dangerous to modify
> because it is in a macro which means if someone decides to use a
> pointer the sizeof will mess up (unless you change the macro). Again,
> not a big issue since it is just a number.
>
> Similar thing in util_md5.c.
>
> util_md5 and util can be fixed easily for consistency, I'm not sure it
> is worthwhile. You will note that there are also some strcpy()s left
> where a "dest = malloc(strlen(src)+1); strcpy(dest, src)" is done.
>
> On Fri, 24 Jan 1997, Brian Behlendorf wrote:
>
> >
> > There's still sprintf's in http_bprintf.c (Ben, do you think you could look at
> > this?), mod_include.c, util.c, and util_md5.c. Is it worth trying to fix these
> > before 1.2b5?
> >
> > Brian
> >
> > --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
> > brian@organic.com www.apache.org hyperreal.com http://www.organic.com/JOBS
> >
>
>
>
--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
brian@organic.com www.apache.org hyperreal.com http://www.organic.com/JOBS
Re: sprintf still around...
Posted by Marc Slemko <ma...@znep.com>.
The stuff in bprintf I did not bother with because you need to understand
what exactly it is doing and I did not have time. It is possible there
are problems left there.
Note the comment above the sprintf in mod_include; it needs to be there
because ap_snprintf() doesn't do quads. It could almost certainly be
changed to a snprintf(), since BSD version that have quad st_size's
should have snprintf(), but it isn't worth the bother because it isn't
a string.
The one in util.c is similar, and is slightly dangerous to modify
because it is in a macro which means if someone decides to use a
pointer the sizeof will mess up (unless you change the macro). Again,
not a big issue since it is just a number.
Similar thing in util_md5.c.
util_md5 and util can be fixed easily for consistency, I'm not sure it
is worthwhile. You will note that there are also some strcpy()s left
where a "dest = malloc(strlen(src)+1); strcpy(dest, src)" is done.
On Fri, 24 Jan 1997, Brian Behlendorf wrote:
>
> There's still sprintf's in http_bprintf.c (Ben, do you think you could look at
> this?), mod_include.c, util.c, and util_md5.c. Is it worth trying to fix these
> before 1.2b5?
>
> Brian
>
> --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
> brian@organic.com www.apache.org hyperreal.com http://www.organic.com/JOBS
>