Bugtraq mailing list archives
Re: StackGuard with ... Re: [Paper] Format bugs.
From: "Greg A. Woods" <woods () weird com>
Date: Mon, 24 Jul 2000 14:31:45 -0400
[ On Monday, July 24, 2000 at 13:16:32 (+0300), Valentin Nechayev wrote: ]
Subject: Re: StackGuard with ... Re: [Paper] Format bugs. It is IMHO really needed to include something similar to GCC's __attribute((format(*printf))) to C standard. All another aspects can be handled with exiting features.
That only helps if you can somehow force the programmer to always hard-code the format string at compile time. Currently this is impossible (I suppose the "format" attribute could do this), and indeed undesirable to many no doubt too! A true fix requires something that would change the language definition in a more fundamental way. I think the best idea would be to revise the calling conventions used for functions with variable numbers of arguments (or perhaps all functions) and defining a new varargs/stdards API (complete with error handling) that can be made a part of the language definition such that a function can discern, at run time, the number of, and type of, parameters it was called with. (Optionally the compiler could include code that verified the arguments of all functions at runtime too!) However as Theo says, that's never [or not likely] going to happen, at least not for the language commonly called `C'. It's already too late for C9X, I think; and it obviously means yet another invention is added to a language that was already pretty well standardardised in 1980 execpt for the fact that some people refused to honour its inventor's ideas faithfully. -- Greg A. Woods +1 416 218-0098 VE3TCP <gwoods () acm org> <robohack!woods> Planix, Inc. <woods () planix com>; Secrets of the Weird <woods () weird com>
Current thread:
- [RHSA-2000:044-02] Updated PAM packages are available., (continued)
- [RHSA-2000:044-02] Updated PAM packages are available. bugzilla () REDHAT COM (Jul 21)
- Re: StackGuard with ... Re: [Paper] Format bugs. Theo de Raadt (Jul 21)
- Roxen security alert: Problems with URLs containing null characters. Peter Bortas (Jul 21)
- Re: StackGuard with ... Re: [Paper] Format bugs. Brett Glass (Jul 21)
- Re: StackGuard with ... Re: [Paper] Format bugs. Greg A. Woods (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. Brett Glass (Jul 25)
- Re: StackGuard with ... Re: [Paper] Format bugs. mixter (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. Linus Akesson (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. Dan Harkless (Jul 25)
- Re: StackGuard with ... Re: [Paper] Format bugs. Valentin Nechayev (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. Greg A. Woods (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. Dick St.Peters (Jul 25)
- Re: StackGuard with ... Re: [Paper] Format bugs. Hannah Schröter (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. Stephen J. Friedl (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. Casper Dik (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. stanislav shalunov (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. Daniel Jacobowitz (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. Alan DeKok (Jul 22)
- Re: StackGuard with ... Re: [Paper] Format bugs. Keith Owens (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. Greg A. Woods (Jul 24)
- Re: StackGuard with ... Re: [Paper] Format bugs. Gerardo Richarte (Jul 24)