bugConcurrent Versions System - Bugs: bug #35432, cvs rls results in %n in writable...


bug #35432: cvs rls results in %n in writable segment detected

Submitter:  None
Submitted:  Wed 01 Feb 2012 11:00:54 PM UTC
Category:  Bug Report Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Release: 
Fixed Release:  None Fixed Feature Release:  None
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:
       No canned response available


Wed 01 Feb 2012 11:00:54 PM UTC, original submission:  

I downloaded and compiled the cvs-1.12.13.tar.gz file.
used gcc (Ubuntu 4.3.2-1ubuntu12) 4.3.2

Then when I (or via redmine/cvs) use the cvs rls command I got a lot of :

      • %n in writable segment detected ***

Terminated with fatal signal 11

I did a simple grep "%n" -R * and found something in the file lib/vasnprintf.c

more google/browsing found


did a minimal change in lib/vasnprintf.c

# if !(_GLIBC_ > 2 || (_GLIBC_ == 2 && _GLIBC_MINOR_ >= 3))
p[1] = '%';
p[2] = 'n';
p[3] = '\0';

/* On glibc2 systems from glibc >= 2.3 - probably also older
   ones - we know that snprintf's returns value conforms to
   ISO C 99: the gl_SNPRINTF_DIRECTIVE_N test passes.
   Therefore we can avoid using %n in this situation.
   On glibc2 systems from 2004-10-18 or newer, the use of %n
   in format strings in writable memory may crash the program
   (if compiled with _FORTIFY_SOURCE=2), so we should avoid it
   in this situation.  */
p[1] = '\0';

and now it works!

I also found the bug #29199 which may apply to this.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.





No changes have been made to this item

Back to the top

Powered by Savane 3.10