"Martin v. Loewis" wrote: > > > Is there some reason why we can't incorporate a free snprintf > > implementation? There is a list available at > > http://www.ijs.si/software/snprintf/. > > Looks like the time machine is at work again: the version we use *is* > a free snprintf implementation. Well, let's say it's a free snprintf emulation ;-) > If you want to replace it with a different one, you should indicate > specifically which one you'd like to use instead. I think Mark > Martinec's implementation (the top one on the URL you give) is > unacceptable, because the license is too restrictive: we must > incoporate the package in its entirety, i.e. redistribution of > portions seems not to be licensed by the Frontier Artistic License. > > I don't have the time to review 10 other implementations for their > suitability both in terms of licensing and correctness. > > Instead, I'd rather review the three occurrences of PyOS_snprintf, to > determine quickly that you will have a hard time to overflow that > buffer; *it is not at all easy*. Even if it does overflow, you will > get a fatal error, rather than silent memory corruption. That is good > enough for me. Note that the version in Python does not result in *stack* overflows which are the type of buffer overflow usually used in exploits. PyOS_snprintf() allocates a buffer on the heap and then let's sprintf() write there -- it then checks for an overflow and causes a fatal error if it finds that sprintf() failed to manage with the size + 512 bytes it had for formatting the string. The only attack on this kind of emulation is a denial of service attack. In the 3 cases where this API is used in Python, an overflow is not possible (unless the native sprintf() implementation is broken). -- Marc-Andre Lemburg CEO eGenix.com Software GmbH ______________________________________________________________________ Consulting & Company: http://www.egenix.com/ Python Software: http://www.lemburg.com/python/
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4