diff options
| author | wiz <wiz@NetBSD.org> | 2008-12-11 09:07:46 +0000 |
|---|---|---|
| committer | wiz <wiz@NetBSD.org> | 2008-12-11 09:07:46 +0000 |
| commit | 5d7029bf64c76edccb8d7edf2279879b41f79e25 (patch) | |
| tree | 5d58be6ce546fbb8aa6a453997b7efcf1adfb22d /lib/libc/stdio | |
| parent | 2c4ff71b65dc3ce6688d1ed1fbce61925d5fbe7f (diff) | |
Sort sections, sort SEE ALSO, remove trailing whitespace.
Diffstat (limited to 'lib/libc/stdio')
| -rw-r--r-- | lib/libc/stdio/printf.3 | 158 |
1 files changed, 79 insertions, 79 deletions
diff --git a/lib/libc/stdio/printf.3 b/lib/libc/stdio/printf.3 index de4f60eb337..6e1705083b2 100644 --- a/lib/libc/stdio/printf.3 +++ b/lib/libc/stdio/printf.3 @@ -1,4 +1,4 @@ -.\" $NetBSD: printf.3,v 1.45 2008/12/11 04:30:57 yamt Exp $ +.\" $NetBSD: printf.3,v 1.46 2008/12/11 09:07:46 wiz Exp $ .\" .\" Copyright (c) 1990, 1991, 1993 .\" The Regents of the University of California. All rights reserved. @@ -386,10 +386,10 @@ equivalent in size to a The following length modifier is valid for the .Cm a , .Cm A , -.Cm e , -.Cm E , -.Cm f , -.Cm F , +.Cm e , +.Cm E , +.Cm f , +.Cm F , .Cm g , or .Cm G @@ -712,7 +712,7 @@ If an output error was encountered, these functions shall return a negative value. .Sh EXAMPLES .br -To print a date and time in the form +To print a date and time in the form .Dq Li "Sunday, July 3, 10:02" , where .Fa weekday @@ -750,77 +750,6 @@ char *newfmt(const char *fmt, ...) return (p); } .Ed -.Sh SECURITY CONSIDERATIONS -The -.Fn sprintf -and -.Fn vsprintf -functions are easily misused in a manner which enables malicious users -to arbitrarily change a running program's functionality through -a buffer overflow attack. -Because -.Fn sprintf -and -.Fn vsprintf -assume an infinitely long string, -callers must be careful not to overflow the actual space; -this is often hard to assure. -For safety, programmers should use the -.Fn snprintf -interface instead. -For example: -.Bd -literal -void -foo(const char *arbitrary_string, const char *and_another) -{ - char onstack[8]; - -#ifdef BAD - /* - * This first sprintf is bad behavior. Do not use sprintf! - */ - sprintf(onstack, "%s, %s", arbitrary_string, and_another); -#else - /* - * The following two lines demonstrate better use of - * snprintf(). - */ - snprintf(onstack, sizeof(onstack), "%s, %s", arbitrary_string, - and_another); -#endif -} -.Ed -.Pp -The -.Fn printf -and -.Fn sprintf -family of functions are also easily misused in a manner -allowing malicious users to arbitrarily change a running program's -functionality by either causing the program -to print potentially sensitive data -.Dq "left on the stack" , -or causing it to generate a memory fault or bus error -by dereferencing an invalid pointer. -.Pp -.Cm %n -can be used to write arbitrary data to potentially carefully-selected -addresses. -Programmers are therefore strongly advised to never pass untrusted strings -as the -.Fa format -argument, as an attacker can put format specifiers in the string -to mangle your stack, -leading to a possible security hole. -This holds true even if the string was built using a function like -.Fn snprintf , -as the resulting string may still contain user-supplied conversion specifiers -for later interpolation by -.Fn printf . -.Pp -Always use the proper secure idiom: -.Pp -.Dl "snprintf(buffer, sizeof(buffer), \*q%s\*q, string);" .Sh ERRORS In addition to the errors documented for the .Xr write 2 @@ -836,10 +765,10 @@ Insufficient storage space is available. .Sh SEE ALSO .Xr printf 1 , .Xr fmtcheck 3 , -.Xr printf 9 , .Xr scanf 3 , .Xr setlocale 3 , -.Xr wprintf 3 +.Xr wprintf 3 , +.Xr printf 9 .Sh STANDARDS Subject to the caveats noted in the .Sx BUGS @@ -954,3 +883,74 @@ The family of functions do not correctly handle multibyte characters in the .Fa format argument. +.Sh SECURITY CONSIDERATIONS +The +.Fn sprintf +and +.Fn vsprintf +functions are easily misused in a manner which enables malicious users +to arbitrarily change a running program's functionality through +a buffer overflow attack. +Because +.Fn sprintf +and +.Fn vsprintf +assume an infinitely long string, +callers must be careful not to overflow the actual space; +this is often hard to assure. +For safety, programmers should use the +.Fn snprintf +interface instead. +For example: +.Bd -literal +void +foo(const char *arbitrary_string, const char *and_another) +{ + char onstack[8]; + +#ifdef BAD + /* + * This first sprintf is bad behavior. Do not use sprintf! + */ + sprintf(onstack, "%s, %s", arbitrary_string, and_another); +#else + /* + * The following two lines demonstrate better use of + * snprintf(). + */ + snprintf(onstack, sizeof(onstack), "%s, %s", arbitrary_string, + and_another); +#endif +} +.Ed +.Pp +The +.Fn printf +and +.Fn sprintf +family of functions are also easily misused in a manner +allowing malicious users to arbitrarily change a running program's +functionality by either causing the program +to print potentially sensitive data +.Dq "left on the stack" , +or causing it to generate a memory fault or bus error +by dereferencing an invalid pointer. +.Pp +.Cm %n +can be used to write arbitrary data to potentially carefully-selected +addresses. +Programmers are therefore strongly advised to never pass untrusted strings +as the +.Fa format +argument, as an attacker can put format specifiers in the string +to mangle your stack, +leading to a possible security hole. +This holds true even if the string was built using a function like +.Fn snprintf , +as the resulting string may still contain user-supplied conversion specifiers +for later interpolation by +.Fn printf . +.Pp +Always use the proper secure idiom: +.Pp +.Dl "snprintf(buffer, sizeof(buffer), \*q%s\*q, string);" |
