glibc vulnerability

["Ryan W. Maple" <ryan () GUARDIANDIGITAL COM>]

Does anybody know exactly where (in the code) the format string
vulnerability exists?  I'm currently "learning" more about buffer
overflows and the such, and have been giving myself homework assignments.
I have gotten the locale exploit to work, but have yet to isolate where in
the code it happens (haven't looked that hard yet).

Does anybody know a file/line number/etc. on where it exists?  Thanks.

                                          /"\
Ryan W. Maple                             \ /     ASCII Ribbon Campaign
Guardian Digital, Inc.                     X      Against HTML & Outlook Mail
ryan () guardiandigital com                  / \     http://www.thebackrow.net