CHEN LINGFENG <[email protected]> writes: > I would like to report a potential security issue in pr. A specially > crafted -D date format can cause an integer wraparound in nstrftime, > resulting in an extremely large size being passed to memset.
Thank you for the report. For future reference, security reports should be sent to [email protected], which is a private list. However, I don't think this is a security issue. I haven't tested it, but based on your report, it sounds like the 'pr' program just crashes. Also, generally, if someone has access to send arbitrary command-line arguments, they have access to a shell where they can do much more harm. Collin
