afrl-rq / OpenUxAS-SoI

Project for multi-UAV cooperative decision making
Other
71 stars 38 forks source link

Fix format string vulnerability #87

Closed Ptival closed 5 years ago

Ptival commented 5 years ago

The functions zyre_set_endpoint, zyre_gossip_bind, and zyre_gossip_connect take as second argument a format string.

While passing a computed string as an argument works, it is a cause for bugs (if the string happens to contain a % character), or worse, a security vulnerability.

Some compilers treat this as an error and will not compiler OpenUxAS as is.