search

deech / fltkhs

Haskell bindings to FLTK GUI toolkit.
MIT License
190 stars 24 forks source link

`flChoice` and `flInput` may crash with a format string #140

Closed deech closed 5 years ago

deech commented 5 years ago

Currently if the first argument to flChoice and flInput a format string it might lead to a segfault because no format arguments are allowed. Not sure of the easiest way around that, is there a reliable format string parser that can test it and reject the call with a suitable error message? @ericu, any thoughts?

ericu commented 5 years ago

Ah, that's a good point. As a simple stopgap, we could just escape all '%' with a second '%' to prevent their being interpreted.

deech commented 5 years ago

I'm less of a C expert, are there any edge cases there? Stop gaps like that tend to become permanent. :)

ericu commented 5 years ago

It seems safe to me; it's how I'd print a literal format string if I didn't want it interpreted. It's also harmless if nobody sends us a format string.

It also applies to flPassword and flMessage.

https://github.com/deech/fltkhs/pull/141

deech commented 5 years ago

Thanks!