Fwd: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG

[Paul Eggert]

Alex wrote:
> I've been trying to figure
> out why the original author used strndupa in the first place but
> haven't wrapped my mind around it yet.

Presumably the original author didn't know about "%.*s".  The string is not 
null-terminated, so "%s" won't work, and I guess the original author used 
strndupa to create a null-terminated copy.

Beware of int overflow when using "%.*s", by the way.