Conversation

Notices

1. Embed this notice
   daniel:// stenberg:// (bagder@mastodon.social)'s status on Tuesday, 14-Jan-2025 19:43:49 JST daniel:// stenberg://

   Turns out snprintf() in old Windows C runtimes is documented to have the buffer overflow that no other implementations do. 🤔

   https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/snprintf-snprintf-snprintf-l-snwprintf-snwprintf-l?view=msvc-170#remarks

   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Tuesday, 14-Jan-2025 19:43:48 JST 翠星石

     in reply to
     @bagder Many such cases has windows "security" been a joke.
   • Embed this notice
     Peter Krefting (nafmo@social.vivaldi.net)'s status on Tuesday, 14-Jan-2025 21:19:06 JST Peter Krefting

     in reply to

     @bagder IIRC it doesn't overflow, it just doesn't nul-terminate. I seem to recall that we had to have a wrapper around MSVC snprintf back at a previous job, to make it behave like a C99 snprintf.

     Remember that snprintf() wasn't standardized until C99, and that the older compilers had their own implementations that weren't quite compatible with each other.