Bug 133125

Summary:	%s on random data is dangerous
Product:	Red Hat Enterprise Linux 3	Reporter:	David Binderman <dcb314>
Component:	sudo	Assignee:	Karel Zak <kzak>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Ben Levenson <benl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3.0
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-05-24 13:12:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Binderman 2004-09-21 19:30:55 UTC

Description of problem:

I just tried to compile package sudo-1.6.7p5-27 from
Redhat Fedora Core 3 Test 1.

The compiler said

sesh.c(21): warning #267: the format string requires additional arguments

The source code is

    snprintf(buf, sizeof(buf), "%s: Couldn't fork");

%s on random data is dangerous. Suggest rework.



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Daniel Walsh 2004-09-29 11:56:06 UTC

Oops, thanks fixed in sudo-1_6_7p5-30

Comment 2 Karel Zak 2005-05-02 19:13:18 UTC

It's valid for RHEL3 too.