Re: Fwd: fix format security

Simon Josefsson via Gnulib discussion list <[email protected]> Mon, 24 Aug 2026 20:25:26 +0200

Newsgroups	gmane.comp.lib.gnulib.bugs
Message-ID	<[email protected]>

Bruno Haible via Gnulib discussion list <[email protected]> writes:

>   - The security of the translations is guaranteed through the workflow
>     (xgettext marks the string with '#, c-format', then 'msgfmt -c' verifies
>     the compatibility of the format string directives in the translation).

Is that protection really complete?  Consider a

printf (_("foo"));

expression, and a maliciously crafted translation.  Could that crash?

I suppose the protection then is that translation files ought to be as
well protected as the binary itself, and that the code that loads the
translations are carefully written to never load anything that is
outside of a trusted installation.  But that seems a bit fragile.

Some defense in depth against translation message confusion doesn't seem
entirely unreasonable IMHO, and the cost of changing the calls into

printf ("%s", _("foo"));

isn't that big.  I've been changing these occurances when I notice them
in code I work on.

How do gcc avoid warning for this?  Is there a special exception for
translation messages or gettext.h somehow?

/Simon

signature.asc (application/pgp-signature, 1.3 KB)