From 89a62bf2907412cb562d22c875736357e314c8c8 Mon Sep 17 00:00:00 2001 From: Rob Landley Date: Mon, 9 Jun 2014 05:51:04 -0500 Subject: When locale is enabled, sprintf("%.123s", str) is counting characters, not bytes, so we can't globally enable locale without opening stack/heap smashing vulnerabilities. Make commands individually request setlocale() using TOYFLAGS instead. --- toys/posix/expand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'toys/posix/expand.c') diff --git a/toys/posix/expand.c b/toys/posix/expand.c index e23dc273..7e668fa7 100644 --- a/toys/posix/expand.c +++ b/toys/posix/expand.c @@ -4,7 +4,7 @@ * * See http://pubs.opengroup.org/onlinepubs/9699919799/utilities/expand.html -USE_EXPAND(NEWTOY(expand, "t*", TOYFLAG_USR|TOYFLAG_BIN)) +USE_EXPAND(NEWTOY(expand, "t*", TOYFLAG_USR|TOYFLAG_BIN|TOYFLAG_LOCALE)) config EXPAND bool "expand" -- cgit v1.2.3