61–70 of 192 posts
Earlier quoted context omitted.
> No. You don't really want to do that. If you're doing that, use puts This is not the case for RO strings, is it?
You're not guaranteed to have a RO string by the standard are you?
> printf("%s\n", "Hello, World!"); > > That's an awful lot of symbolic syntax. Well... Because it should have been printf("Hello, World!\n"); in the first place? One can do something like printf("%s,%s%c\n", "Hello", "World", '!'); and claim that C is awful and that displayln("Hello, World!"); is so much better.
How about just puts(“Hello, World!”) which has been in C since the dawn of time?
Earlier quoted context omitted.
You're not guaranteed to have a RO string by the standard are you?
Good point. I suppose that you are talking about overwriting terminating NUL, do I get it right? puts() is vulnurable in exactly same way.
Earlier quoted context omitted.
Can you please exemplify how you exploit a printf("Hello, World!\n") ?
That's a format string attack [0]. By modifying the start of that string, you can begin reading and writing to various parts of the stack. Whilst implementations may inline that string into a RO memory region - that's not defined behaviour, so you shouldn't depend on it. [0] https://owasp.org/www-community/attacks/Format_string_attack
Earlier quoted context omitted.
That's a format string attack [0]. By modifying the start of that string, you can begin reading and writing to various parts of the stack. Whilst implementations may inline that string into a RO memory region - that's not defined behaviour, so you shouldn't depend on it. [0] https://owasp.org/www-community/attacks/Format_string_attack
By that same logic, puts("Hello, world!"); is also vulnerable to DoS attack and information leak since someone could have removed the NUL terminator at the end of the string and have puts() read uninitialized/unmapped memory. Which is absurd logic.
> Originally thought harmless, format string exploits can be used to crash a program or to execute harmful code.
They are not the same as puts. Puts can allow you to potentially read memory.
A format string attack can allow you to write to memory.
[0] https://en.wikipedia.org/wiki/Uncontrolled_format_string
Earlier quoted context omitted.
I love the simple and lightweight interface, but everything is hard to discover. Sourcehut? Sounds great- I'd love to replace my Gogs/gitlab instance with something more lightweight. Let's download the source and run it. I guess click on "git" on https://git.sr.ht/ ? Wait that's where I already am with no indication that that is the selected tab. Ok maybe the link for sourcehut? https://sourcehut.org/ Cool. There's s…
It sounds like you're going to the main page, expecting to download it and deploy it yourself. It isn't surprising that the main interface is pointing you to _use_ it, rather than deploy it. If you click on the help hub, _man_, you'll find what you're looking for straight away: > Hacking on or deploying sourcehut yourself? Resources here. --- > I guess click on "git" on https://git.sr.ht/ ? Wait that's where I alread…
That looks part of the "logo", not part of the navbar. There is at most a minimal difference in the actual "tabs". Of course the reason is that this isn't actually a navbar/tabs but a list of applications offered by sourcehut, this is really noticeable if you click on git when you're at an actual git repository (e.g. https://git.sr.ht/~sircmpwn/scdoc) note that the red text highlighting where I am already says git, so clicking on git shouldn't do anything if it was actually a tab bar, but in reality it navigates to https://git.sr.ht/
> printf("%s\n", "Hello, World!"); > > That's an awful lot of symbolic syntax. Well... Because it should have been printf("Hello, World!\n"); in the first place? One can do something like printf("%s,%s%c\n", "Hello", "World", '!'); and claim that C is awful and that displayln("Hello, World!"); is so much better.
double foo = 1.2;
printf(foo);
puts(foo);
double foo = 1.2;
display(foo);
Incidentally I actually think display is the only thing on this list that is probably worth using, you could also probably extend it to accept multiple arguments relatively simply as well.
> printf("%s\n", "Hello, World!"); > > That's an awful lot of symbolic syntax. Well... Because it should have been printf("Hello, World!\n"); in the first place? One can do something like printf("%s,%s%c\n", "Hello", "World", '!'); and claim that C is awful and that displayln("Hello, World!"); is so much better.
displayln is a _Generic. All of these are valid: displayln("Hello, World!"); displayln(100); displayln(1.8); The point is, for simple things, to not have to specify how they appear. > Well... Because it should have been > printf("Hello, World!\n"); No. You don't really want to do that. If you're doing that, use puts [0] . All this requires is a modification to one string in memory and you have an injection vulnerabil…
I'm pathologically lazy.
Also as others point out typically the literal string will be in a ro segment so tampering with it won't be easy unless the code runs in a rather exotic environment.
Earlier quoted context omitted.
If the string was in a variable, yes, but in this case most implementations will put it in a RO section.
That'll be depending on undefined behaviour, though, correct?