Bugtraq: Re: modifing libc to discover gets()/sprintf() calls

[alan () LXORGUK UKUU ORG UK (Alan Cox)]

> The only big problem I is that any difference between the libc.a and
> the running libc.so shared library would become painfully obvious
> after creating and installing the new shared library with the
> printf modifications.
Well one other approach would be to use some kind of ELF extension to
mark a symbol of type 'text, insecure'. Then the linker would link the binary
and report

fooprog: symbol _gets is insecure
fooprog: symbol _sprintf is insecure

Alan