Fwd: [PATCH] Don't allow attackers to inject arbitrary data into stack through LD_DEBUG

[Rich Felker]

On Mon, Aug 10, 2015 at 11:15:36AM +0200, Andreas Schwab wrote:
> Paul Eggert <eggert@cs.ucla.edu> writes:
> 
> > Presumably the original author didn't know about "%.*s".
> 
> It didn't exist back then.

This is factually incorrect. C89 4.9.6.1 paragraph 3 specifies the *
form for width and precision. printf has 'always' had this feature, or
at least since long before there was a GNU dynamic linker.

Rich