Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20101007105549.7383eb92@redhat.com>
Date: Thu, 7 Oct 2010 10:55:49 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Nagios format string issues

On Wed, 6 Oct 2010 21:56:09 +0200 Oden Eriksson wrote:

> I just extracted the patches I made at the time. I cannot tell which
> of them deserves CVE assignments though. I have put them here:
> 
> http://n1.nux.se/work/format_not_a_string_literal_and_no_format_arguments/

Did you use any specific way to identify all these?  From a quick look
at a few randomly chosen patches, there seem to be cases where one call
was fixed, other left unchanged.  That's only for the code visible in
the context diff.

There are few incorrect fixes too:

-  g_snprintf (gev.data.b, sizeof (gev.data.b), message);
+  g_snprintf (gev.data.b, sizeof (gev.data.b), message, "%s");

-- 
Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.