Hello Martin,

On 11/23/2012 12:59 PM, Martin Simmons wrote:
>> ..
> Ah, sorry, you are right.  I didn't know that Bacula had its own format
> directives.

No reason to be sorry.  It is not too well known.  There are two reasons
we have our own print formatting subroutines:

1. I wanted something more secure than glibc to remove some of the
strange formatting of printf that easily leads to exploits (stuff like 
%*n ...)

2. The idea that the meaning of %ld changes depending on whether
your architecture is 32/64 bits, IMO, is crazy.

In addition, virtually all Bacula prints when the string is already 
formatted
are of the type bsnprintf(buf, size, "%s", msg); rather than
bsnprintf(buf, size, msg) to avoid malicious character injection.
It requires an additional pass over the string but eliminates a lot
of possible problems.

Best regards,
Kern



------------------------------------------------------------------------------
Monitor your physical, virtual and cloud infrastructure from a single
web console. Get in-depth insight into apps, servers, databases, vmware,
SAP, cloud infrastructure, etc. Download 30-day Free Trial.
Pricing starts from $795 for 25 servers or applications!
http://p.sf.net/sfu/zoho_dev2dev_nov
_______________________________________________
Bacula-devel mailing list
Bacula-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bacula-devel

Reply via email to