On 5/1/07, Haoqi H. firstname.lastname@example.org wrote:
sprintf(buf,"%s after %s",s1,s2);
You have to be very careful when working with c. The code above has a
couple of classic security vulnerabilities.
Since you are not dealing with user-controlled buffers, it’s not that
a deal, but here’s a couple tips:
- in general, don’t use sprintf. use snprintf().
char * s1 = "a ";
char * s2 = “b “;
snprintf(buf,sizeof(buf),”%s after %s”,s1,s2);
- always use a string literal as the format string to functions which
them ( printf() , snprintf() , etc… ):
If you’re interested in what can be done if these errors are made, check