Re: [musl] [PATCH] [RFC] trap on invalid printf formats

[Rich Felker <dalias@libc.org>]

On Thu, Jun 22, 2023 at 04:35:54PM +0200, Markus Wichmann wrote:
> Am Wed, Jun 21, 2023 at 05:37:49PM -0400 schrieb Rich Felker:
> > Inspired by a new instance of some bitrotted software using %Lu
> > instead of %llu, attached is a draft patch to catch such errors rather
> > than silently leaving missing output.
> >
> 
> Ah, it's the old dichotomy: For developers, this is nice, since it
> catches bad behavior in a way that is impossible to ignore. For users,
> this is horrible, since it crashes bad applications, maybe just before
> they could save their data. And making the behavior selectable is
> probably not sensible.
> 
> As I count myself among the former group, I do support this move. But
> then, I do not run a distro, and the only computer I am responsible for
> is my own.

Even for users, I'm not so sure of that. The distinction is
potentially between crashing while writing out a new file containing
corrupted data before rename()ing it over the old file, and silently
succeeding then rename()ing the corrupted file over the old file.

(Note that this is only silent if you don't check for errors, but if
anyone using invalid formats were checking for errors, it seems these
errors would necessarily have been reported. Unless they just check
ferror() at the end, and we're not setting the FILE error flag on
format string errors...which we probably should do if we don't switch
to trapping.)

FWIW I don't think there are a lot of these cases left in the wild at
all, but I'm not sure. it might be nice to do some distro-wide testing
with this patch applied (which is what I had in mind posting it) and
see if any problems are caught before really considering whether to
pursue upstreaming it.

Rich