Re: Secure C programming & format strings

From: James (hoosier45678@hotmail.com)
Date: 04/11/03 

From: James <hoosier45678@hotmail.com>
Date: Thu, 10 Apr 2003 21:43:43 -0700

On 11 Apr 2003 00:17:40 GMT, roberson@ibd.nrc-cnrc.gc.ca (Walter
Roberson) wrote:

>In article <b74um7$sfh$1@tabloid.uwaterloo.ca>,
>David Canzi <dmcanzi@watserv1.uwaterloo.ca> wrote:
>:I have a hunch. Try this experiment. Change that fprintf to:
>: fprintf(stderr, somversion);
>
>:Change the declaration to:
>: const char *somversion = "Stack-0-Mibs Version 0.30 - \n";
>
>:Run the code auditor again.
>
>:If my hunch is right, I hope fixing the problem doesn't involve doing
>:the above operation on all your printfs.
>
> fprintf(stderr, (const char *) "Stack-0-Mibs Version 0.30 - \n" );
>
>perhaps.

I know for certain that string literals are constant by default,
unless they are used in an array initialization (char* s1="abc" is
constant, but char s2[] = "abc" is not)

But in any case, it is the "constant-ness" of the format string, and
not the string itself, that the tool is tagging incorrectly(?)

Relevant Pages

  • Re: How to add thousand separators
    ... First, this code is obsolete as written, because char is a dead data type and should not ... Note that both of these should be stored as string resources since they might need to be ... 18 digits for any reason. ... you have made a VERY SERIOUS DESIGN ERROR. ...
    (microsoft.public.vc.mfc)
  • Re: what is the best way of passing floats into a string
    ... I do not null-terminate as snprintf takes care of this (according to ... But the easiest way to determine the size needed to format a number, ... int length_of_representation(double n,const char* format){ ... I get a nice result of -10.000000 in my char * string. ...
    (comp.unix.programmer)
  • Re: weird problem
    ... I already told you that the comparison between an integer and a float ... to strcmpwhich expects a pointer to a string. ... And now a question about something else: why do you use floating ... int,float, char, etc. ...
    (comp.lang.c)
  • Re: [OT] My First C# (warning - long post)
    ... cut me some slack - show me a COBOL program with less than 15 working-storage variables! ... Yes, the Trimis probably extra now, but that was my attempt to get it to quit griping at me that I had given it a "String", when it wanted a "char". ... public string IBreturn ...
    (comp.lang.cobol)
  • Re: why I can not write to the file after initialize the MFC in a service program
    ... you don't use char, an obsolete data type ... Why do you need an intermedate buffer to write literal strings anyway? ... For example, if AfxWinInit fails, you copy a 45-character string into a ... So you are going to try to initialize MFC EACH TIME THROUGH THE LOOP? ...
    (microsoft.public.vc.mfc)
Quantcast