bug-bash
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

possible buffer overflow by bad translation


From: Roland Illig
Subject: possible buffer overflow by bad translation
Date: Sun, 15 Sep 2019 20:24:20 +0200
User-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0

>From siglist.c:

          sys_siglist[i] =
            (char *)xmalloc (10 + strlen (_("Unknown Signal #")));

          sprintf (sys_siglist[i], _("Unknown Signal #%d"), i);

If the translator doesn't look at the code using these two messages,
they may be translated in a totally different way. Luckily, in the
current German translation, the malloc string is only one character
shorter than the sprintf string, therefore this bug would only cause
undefined behavior for very large signal numbers.

Nevertheless, this must be fixed. The same string must be used for
xmalloc and sprintf. What about the standard pattern of using snprintf
with a null pointer first, to determine the actually needed memory?



reply via email to

[Prev in Thread] Current Thread [Next in Thread]