Hi, all, I've done a quick search of the Gnulib discussion list archives and have not seen this issue raised:
Is it worth adding strfmon(3) and possibly strfmon_l(3) for those systems that do not have it? I'm thinking primarily OpenBSD, even the latest version. This OS does not have <monetary.h> either. I have a little game (at https://www.zap.org.au/software/trader/) that someone has requested be ported to OpenBSD. Given that this program is written in C, and that OpenBSD does not have strfmon(3), the compile fails. Gnucash gets around this issue by including strfmon.c from FreeBSD. Unfortunately, the version included has an integer overflow vulnerability, fixed in FreeBSD back in 2011, but not updated in Gnucash. Yes, I'll file a bug report... Adding either the version of strfmon(3) from the GNU C Library, or at worst the current FreeBSD version (2-clause BSD licence) to Gnulib will hopefully mitigate security oversights like this. With appropriate macros, it might also allow problematic implementations (such as possibly with macOS?) to be overridden with a decent one. If the Gnulib maintainers are agreeable, I'll try setting aside some time in the next couple of weeks to come up with a suitable patch or git repository you can pull from. If so, what is your preferred procedure for patch submission etc.? PS: Please include my email address in a CC--I'm not (yet) subscribed to the Gnulib mailing list. Yours truly, John Zaitseff -- John Zaitseff ,--_|\ The ZAP Group Phone: +61 2 9643 7737 / \ Sydney, Australia E-mail: j.zaits...@zap.org.au \_,--._* http://www.zap.org.au/ v
