On 10.12.2013 00:01, Les Howell wrote:
> On Mon, 2013-12-09 at 15:59 -0700, Rich Megginson wrote:
>> On 12/09/2013 03:33 PM, Przemek Klosowski wrote:
>>
>>> On 12/06/2013 09:21 AM, Ralf Corsepius wrote:
>>>
>>>>
>>>> printf(string) is legitimate C, forcing "printf("%s", string) is
>>>> just silly.
>>>>
>>> My apologies for being repetitive, but the original point is that
>>> printf(string) is insecure unless you can guarantee that you control
>>> 'string' now and forever. Also, %s is the format for printing
>>> strings, so I just can't agree that coding printf("%s", string) is
>>> silly.
>>
>> Silly is not the right word. printf("%s", string) is inefficient. In
>> this case, it would be better to use puts/fputs.
>>
> unless something has changed recently fputs and puts just like gets and
> fgets have been deprecated and are discouraged due to potential security
> issues.
>
>
Something must have changed. GCC uses puts instead of printf in some
cases. Please, see below:
$ cat p.c
#include <stdio.h>
int main()
{
printf("Hello world!\n");
return 0;
}
$ gcc -S p.c
$ cat p.s
.file "p.c"
.section .rodata
.LC0:
.string "Hello world!"
.text
.globl main
.type main, @function
main:
.LFB0:
.cfi_startproc
pushq %rbp
.cfi_def_cfa_offset 16
.cfi_offset 6, -16
movq %rsp, %rbp
.cfi_def_cfa_register 6
movl $.LC0, %edi
call puts
movl $0, %eax
popq %rbp
.cfi_def_cfa 7, 8
ret
.cfi_endproc
.LFE0:
.size main, .-main
.ident "GCC: (GNU) 4.8.2 20131017 (Red Hat 4.8.2-1)"
.section .note.GNU-stack,"",@progbits
Mateusz Marzantowicz
--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
