Bug 836931

While looking into some format string issue, i found that the warn() function does not seem to be protected by the glibc FORTIFY_SOURCE Format string protection mechanism.

Here is a simple example to prove my point:

[huzaifas@babylon ~]$ cat warn1.c 
#include <stdio.h>
#include <err.h>

void main(int argc, char *argv[])
{
warn(argv[1]);
//printf(argv[1]);
}

[huzaifas@babylon ~]$ gcc -O -g -D_FORTIFY_SOURCE=2 -o warn warn1.c
[huzaifas@babylon ~]$ cat print.c 
#include <stdio.h>
#include <err.h>

void main(int argc, char *argv[])
{
//warn(argv[1]);
printf(argv[1]);
}
[huzaifas@babylon ~]$ gcc -O -g -D_FORTIFY_SOURCE=2 -o print print.c

[huzaifas@babylon ~]$ ./warn "%100s%n"
warn:                                                                                               ?&#9646;&#65533;: Segmentation fault
[huzaifas@babylon ~]$ ./print "%100s%n"
*** %n in writable segment detected ***
                                                                                              L&#65533;|&#65533;Aborted
[huzaifas@babylon ~]$