Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!rutgers!apple!oliveb!sun!eureka!argv
From: argv%eureka@Sun.COM (Dan Heller)
Newsgroups: comp.sources.bugs
Subject: Re: Bug in csh (history, "!a%100s"). Report and Fix.
Keywords: csh history format-string bug fix
Message-ID: <113630@sun.Eng.Sun.COM>
Date: 4 Jul 89 17:41:24 GMT
Sender: news@sun.Eng.Sun.COM
Reply-To: island!argv@sun.com (Dan Heller)
Lines: 36

Why are people so stuck on using printf?  Michael Greim finds a bug
in csh because it misuses printf, yet the fix (altho it works) continues
to use printf -- I have nothing against using printf, but this is a very
costly function when you compare it to something like fputs or puts.
(Have you ever seen the source to printf()?)  But more importantly, it
causes severe bugs with programs that are sometimes hard to trace.

In article greim@sbsvax.UUCP (Michael Greim) writes:
> ! 	if (s) {
> ! 		i = strlen (s) - 1;
> ! 		if (s[i] == '@') {
> ! 			s[i] = '\0';
> ! 			printf(s, arg), printf(".\n");
> ! 		} else
> ! 			printf("%s\n", s);
> ! 	}

How about this:
		if (s[i] == '@') {
			s[i] = '\0';
			printf(s, arg), puts(".");
		} else
			puts(s);

Now don't get me wrong, I realize that this is a trivial "simple" thing
that one might say, "give me a break."  But the fact that people are not
as conscientious about how printf is used is the reason that the bugs
recently found is csh are created.  A much more important bug that I've
found as a result of the same errors is when programs write out data to
files using fprintf.  As soon as there is a %s in the data written, you
just created a junk file.  And this is also the type of bug that doesn't
present itself frequently.

dan <island!argv@sun.com>
-----
My postings reflect my opinion only -- When on the net, I speak for no company.