Messages in this thread | | | Date | 13 Sep 2013 15:49:15 -0400 | From | "George Spelvin" <> | Subject | Re: [PATCH] vsprintf: drop comment claiming %n is ignored |
| |
> Why would you want to artificially make the function diverge > from the spec?
Because %n make it easy to convert a not-uncommon format string bug into a code injection. Thus, poses a significant security vulnerability.
Since it's an obscure and rarely-used feature, it is straightforward to eliminate all users in the Linux kernel, making removing it possible.
I agree that if it were harmless, it would be useful to leave it implemented just for simplicity (it's a trivial amount of code), but it's not harmless.
> People shouldn't be caught by surprises if at all > possible, and one can certainly not expect people to go look at > the comment before the function implementation to find out > what basic (standard) features _do not_ work (one can expect > so when trying to find out about _extensions_).
This is why people propose implementing it as a kernel warning.
Strongly support this change.
| |