In coreutils 8.12 (latest), printf can make an out-of-bounds access when an integer argument consists only of a single or double quote.

The printf spec mentions that an integer argument consisting of a single/double quote followed by a character is interpreted as the ASCII value of that character. However, when the quote is alone, the code in the STRTOX macro (printf.c:171) goes beyond the buffer associated with the argument.

Possible fix: report an error at printf.c:166 if ch is 0.


Paul



Reply via email to