[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#190937: Unsafe use of asprintf () in anna



Package: anna
Version: 0.026, HEAD

This concerns the following files:

debian-installer/anna/anna.c
debian-installer/anna/util.c

AFAIK asprintf() in glibc doesn't guarantee to nullify the supplied first
pointer in case of failure. Thus, the pointer might point to anywhere.
Its value is simply undefined. The correct way is to check whether
asprintf() returns -1. Even if glibc was changed so that it nullifies
the pointer, I somehow doubt it's a good idea simply passing it to
various functions. 

(I don't use Debian, so this report might be incomplete.)

-- 
Christian

Attachment: pgp3gqv7JSgIb.pgp
Description: PGP signature


Reply to: