Project

General

Profile

Bug #275

string-appending sprintf calls relying on undefined behavior

Added by Nicholas Breen almost 11 years ago. Updated almost 11 years ago.

Status:
Closed
Priority:
Normal
Category:
analysis tools
Target version:
Affected version - extra info:
Affected version:
Difficulty:
uncategorized
Close

Description

Created an attachment (id=334)
replace sprintf() calls with well-defined semantics

There are three places in the code where a construct of this sort is used to append onto a string:

sprintf(buf, "%s and other stuff", buf);

...which is explicitly undefined behavior under C99, and will not work as anticipated (truncating instead of appending) with gcc-4.3 if -D_FORTIFY_SOURCE=2 is set.

What's there now should work under default compiler options everywhere at this time, but could lead to problems down the line if C99 compliance starts getting improved - and it's a nicely trivial patch to rewrite those calls in a portable manner.

(Further discussion: http://lists.debian.org/debian-devel/2008/12/msg01079.html)

sprintf.patch (1.18 KB) sprintf.patch replace sprintf() calls with well-defined semantics Nicholas Breen, 12/31/2008 08:38 PM

History

#1 Updated by Erik Lindahl almost 11 years ago

Fixed in the release branch - thanks! We will join all these patches into head after the 4.0.3 release...

Also available in: Atom PDF