path: root/coreutils/printf.c
diff options
authorGravatar Ron Yorston <rmy@pobox.com>2017-07-18 09:33:22 +0100
committerGravatar Denys Vlasenko <vda.linux@googlemail.com>2017-07-18 16:00:38 +0200
commit513a2457b65894b10b9fd6aa8753fca59eced08c (patch)
tree0276a3c9b9f7752133c8a6d2f5bc18fafbaee5a6 /coreutils/printf.c
parentcf5110978ba25002ec5cb46aaae2472eb66001ac (diff)
printf: fix format string sanity check
One of the tests for printf checks for an invalid bare '%' in the format string: $ busybox printf '%' a b c printf: %: invalid format On x86_64 a slightly different test doesn't work correctly: $ busybox printf '%' d e f printf: invalid number 'd' printf: invalid number 'e' printf: invalid number 'f' On other platforms the test fails randomly depending on how the arguments are laid out in memory. There are two places in the code where strchr is used to determine if a character in the format string is valid. However, strchr also returns a valid pointer if the character being searched for is the null terminator thus causing the code to incorrectly suppose that a valid character has been found. Add explicit checks for the null terminator. Signed-off-by: Ron Yorston <rmy@pobox.com> Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'coreutils/printf.c')
1 files changed, 2 insertions, 2 deletions
diff --git a/coreutils/printf.c b/coreutils/printf.c
index bc22e0ee7..65bb5a935 100644
--- a/coreutils/printf.c
+++ b/coreutils/printf.c
@@ -305,7 +305,7 @@ static char **print_formatted(char *f, char **argv, int *conv_err)
- if (strchr("-+ #", *f)) {
+ if (*f && strchr("-+ #", *f)) {
@@ -348,7 +348,7 @@ static char **print_formatted(char *f, char **argv, int *conv_err)
static const char format_chars[] ALIGN1 = "diouxXfeEgGcs";
char *p = strchr(format_chars, *f);
/* needed - try "printf %" without it */
- if (p == NULL) {
+ if (p == NULL || *f == '\0') {
bb_error_msg("%s: invalid format", direc_start);
/* causes main() to exit with error */
return saved_argv - 1;