bug-gnulib@gnu.org mirror (unofficial)
 help / color / mirror / Atom feed
* printf with %n directives
@ 2024-02-20 15:46 Bruno Haible
  2024-02-21 14:54 ` Bruno Haible
  0 siblings, 1 reply; 3+ messages in thread
From: Bruno Haible @ 2024-02-20 15:46 UTC (permalink / raw)
  To: bug-gnulib

In <https://lists.gnu.org/archive/html/bug-gnulib/2023-08/msg00033.html> I wrote:
> I cannot guarantee that Gnulib will be able to support %n
> in the long run. The "security-aware community" are filing CVEs here and
> there; %n is among their targets (it has already been disabled from libc
> on Ubuntu, macOS, and MSVC); and I don't know when they will discover
> that Gnulib still enables it.

The way I propose to do it:
  - Remove the support for the %n directives from all *printf* modules
    by default.
  - Add a new module 'printf-with-n-directive' that re-enables this support
    in all these modules.
  - Add a NEWS entry to notify the packages.

This way, most packages that use Gnulib *printf will be immune against
possible CVEs in this area.

I'm also considering making the same move in GNU libintl.

Bruno





^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2024-02-23 12:11 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-02-20 15:46 printf with %n directives Bruno Haible
2024-02-21 14:54 ` Bruno Haible
2024-02-23 12:09   ` Bruno Haible

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).