Re: sprintf security holes?

[Morten Welinder <mwelinder@gmail.com>]

> Since sprintf() can lead to buffer overflows from unprotected user
> data, and you want to use git in server situtations, wouldn't it be
> prudent to eliminate those in some near-ish timeframe?

I assume you mean make them into snprintf calls.

I don't think that really buys you anything, i.e., there would still be far
too many places where character pointers are derefenced and
assigned to.  You would probably have to create a small (and thus
auditable) generic strings library and do all string creation within
that.  That is certainly feasible, but evidently not Linus style.

There really is nothing wrong with sprintf that couldn't be said to be
wrong with snprintf, strcpy, strncpy, *p++ = 0, etc.  If you don't have
the right amount of memory allocated, you lose.  (Yes, that goes for
the "n" versions too, although in many cases you could syntactically
check that a "sizeof" was used.  Then you just get to worry whether
random truncation introduced other security problems.)

Morten