<div><br><div><br><div class="gmail_quote">On Wed, Apr 18, 2012 at 7:42 PM, Daniel Stone <span dir="ltr"><<a href="mailto:daniel@fooishbar.org">daniel@fooishbar.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hi,<br> <div class="im"><br> On 18 April 2012 10:51, Daniel Kurtz <<a href="mailto:djkurtz@chromium.org">djkurtz@chromium.org</a>> wrote:<br> > Input drivers like to prepend the device name to logging messages using<br> > LogVHdrMessageVerb(). The current implementation of this function used the<br> > output of a snprintf() as the format string of another snprintf(). This is a<br> > big no-no, as a device name containing format strings could cause "Bad Things"<br> > to happen.<br> <br> </div>... really? If the kernel, root (given that /dev/input is 600<br> root:root by default) or your keyboard hardware is trying to attack<br> you, I'm pretty sure format strings in device names are the least of<br> your worries.<br></blockquote><div><br></div><div>Bluetooth device names are commonly assigned by users.<div>Including the possible name "%n%n%n%n".</div><div>That name may crash X.</div></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Cheers,<br> Daniel<br> </blockquote></div><br></div></div>