When locale is enabled, sprintf("%.123s", str) is counting characters, not bytes, so we can't globally enable locale without opening stack/heap smashing vulnerabilities. Make commands individually request setlocale() using TOYFLAGS instead.

1 files changed, 4 insertions, 0 deletions

diff --git a/toys.h b/toys.h
index 6666cfbf..9fd338ab 100644
--- a/toys.h
+++ b/toys.h
@@ -105,6 +105,10 @@ void toy_exec(char *argv[]);
 #define TOYFLAG_NEEDROOT (1<<7)
 #define TOYFLAG_ROOTONLY (TOYFLAG_STAYROOT|TOYFLAG_NEEDROOT)
 
+// Call setlocale to listen to environment variables.
+// This invalidates sprintf("%.*s", size, string) as a valid length constraint.
+#define TOYFLAG_LOCALE   (1<<8)
+
 // Array of available commands
 
 extern struct toy_list {