Re: Defect in XSH asctime()

["Clive D.W. Feather" <yyyyy@xxxxxxxxx>]

H. Peter Anvin said:
>> WG14 examined this issue quite a long time ago. We decided that the
>> behaviour was simply undefined. There is no requirement that a particular
>> string appear in the buffer, or even that the function call returns in a
>> sensible state (or at all). It's *UNDEFINED*.
> 
> I would classify that as a security hazard.

So is much of the C Standard library when misused. The answer is to do
validation elsewhere (though there are moves towards a new, secure,
library).

-- 
Clive D.W. Feather  | Work:  <yyyyy@xxxxxxxxx>   | Tel:    +44 20 8495 6138
Internet Expert     | Home:  <yyyyy@xxxxxxxxxx>  | *** NOTE CHANGE ***
Demon Internet      | WWW: http://www.davros.org | Fax:    +44 870 051 9937
Thus plc            |                            | Mobile: +44 7973 377646