Re: bin/38327: uu{en,de}code - any reason to use non-portable [sg]etprogname?

[David Holland <dholland-bugs%netbsd.org@localhost>]

On Sat, Mar 29, 2008 at 03:55:02PM +0000, Aleksey Cheusov wrote:
 >  Not a discussion :) Just a note.
 >  Using setprogname(argv [0]) may be dangerous for SUID programs.
 >  Invalid argv [0] may be passed through execv(2).

More to the point, using getprogname() may be dangerous in setugid
programs. The information comes from argv[0] in any event. Have you
found any problematic uses?

(It is roughly similar to how using getenv() may be dangerous in
setugid programs.)

-- 
David A. Holland
dholland%netbsd.org@localhost