ftpd and setproctitle()

[deraadt () CVS OPENBSD ORG (Theo de Raadt)]

Well, while everyone is talking about setproctitle affecting wuftpd,
I should probably note that it even affects the OpenBSD ftpd.  In fact,
looking around, it looks like it might affect everyone's ftpd.

Our patch is at

        http://www.openbsd.org/errata.html#ftpd

We're currently going through our tree looking for *printf(), err*(),
warn*(), syslog(), setproctitle(), and even curses *print*() functions
that might have issues like this.  We did this before for the *printf
family, perhaps 3 years ago, but even now we are discovering a few that
we have missed.

It's scary, and quite a bit of work to check every such call.  They
happen a lot..