safely concatenating strings in portable C (Re: GnuPG 1.4 and 2.0 buffer overflow)

2006-11-30 Thread Solar Designer
On Mon, Nov 27, 2006 at 06:13:02PM +0100, Werner Koch wrote: > +n = strlen(s) + (defname?strlen (defname):0) + 10; > prompt = xmalloc(n); > if( defname ) > sprintf(prompt, "%s [%s]: ", s, defname ); ... > Note, that using snprintf would not have helped in > this case. How I w

Re: safely concatenating strings in portable C (Re: GnuPG 1.4 and 2.0 buffer overflow)

2006-12-01 Thread Simon Josefsson
Solar Designer <[EMAIL PROTECTED]> writes: > However, in those (most common) cases when all you need is to concatenate > strings, relying on or providing an snprintf() implementation might be > an overkill. Gnulib's xvasprintf detects %s...%s format strings, which makes the code easy to analyse f