From: | Heikki Linnakangas <heikki(dot)linnakangas(at)enterprisedb(dot)com> |
---|---|
To: | Grzegorz Jaskiewicz <gj(at)pointblue(dot)com(dot)pl> |
Cc: | Peter Eisentraut <peter_e(at)gmx(dot)net>, pgsql-hackers Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Fixes for compiler warnings |
Date: | 2009-01-18 15:00:56 |
Message-ID: | 49734428.7090308@enterprisedb.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
Grzegorz Jaskiewicz wrote:
> On 2009-01-18, at 09:56, Peter Eisentraut wrote:
>> -Wformat-security warns about
>>
>> printf(var);
>>
>> but not about
>>
>> printf(var, a);
>>
>> I don't understand that; the crash or exploit potential is pretty much
>> the
>> same in both cases.
> not at all. First case allows you to pass in var from outside, with
> your, well crafted format strings. Please read more about subject,
> before you say something that silly.
The point is that if "var" comes from an untrusted source, both forms
are just as dangerous.
I guess that in practice, the first form is more likely to be an oversight.
--
Heikki Linnakangas
EnterpriseDB http://www.enterprisedb.com
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2009-01-18 18:17:57 | Re: Fixes for compiler warnings |
Previous Message | Andrew Chernow | 2009-01-18 14:18:29 | Re: VARSIZE - why omit VARLEN? |