Hi,
Jan Stary wrote on Thu, Jan 10, 2019 at 09:35:48PM +0100:
> Does locate(1) need to setlocale(3)?
Committed as part of a much larger diff.
Note that answering that question required substantial code review
and code cleanup.
When auditing, don't just mechanically look for suspicious patterns.
You have to actually inspect and understand the code to make an
an audit useful. Something like the patch below is merely a
starting point for an audit (trivial to find), not a result.
Yours,
Ingo
> Index: locate/locate.c
> ===================================================================
> RCS file: /cvs/src/usr.bin/locate/locate/locate.c,v
> retrieving revision 1.31
> diff -u -p -r1.31 locate.c
> --- locate/locate.c 19 Nov 2015 21:46:05 -0000 1.31
> +++ locate/locate.c 10 Jan 2019 20:34:16 -0000
> @@ -73,7 +73,6 @@
> #include <fnmatch.h>
> #include <libgen.h>
> #include <limits.h>
> -#include <locale.h>
> #include <stdio.h>
> #include <stdlib.h>
> #include <string.h>
> @@ -122,7 +121,6 @@ main(int argc, char *argv[])
> {
> int ch;
> char **dbv = NULL;
> - (void) setlocale(LC_ALL, "");
>
> if (pledge("stdio rpath", NULL) == -1)
> err(1, "pledge");
