Re: Translating format strings
On Sun, Mar 10, 2002 at 06:22:05PM +0100, Marcelo E. Magallon wrote:
> Hi,
>
> I'm sorry if this is a bit off-topic, it concerns a wishlist bug in one
> of my packages.
>
> printf(_("Writing frame: %d %d => %d bytes\n"), ...);
>
> Would that be exploitable? The program in question is a regular
> gtk app, not setuid or anything like that.
No, gettext is supposed to handle this correctly. If you're setuid
and you use the gettext in glibc, translation will be disabled. If you
allow some other way for users of the program to cause your environment
variables to be changed, and run as a server, then you're just stupid
:). Similarly if there is an installed message catalog with the wrong
number of %d specifiers or such, then that's a bug.
In general, it's fine.
--
Daniel Jacobowitz Carnegie Mellon University
MontaVista Software Debian GNU/Linux Developer
Reply to: