=================================================================== RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/printf/printf.1,v retrieving revision 1.12 retrieving revision 1.13 diff -u -r1.12 -r1.13 --- src/usr.bin/printf/printf.1 2000/10/19 18:18:54 1.12 +++ src/usr.bin/printf/printf.1 2001/02/17 17:15:27 1.13 @@ -1,4 +1,4 @@ -.\" $OpenBSD: printf.1,v 1.12 2000/10/19 18:18:54 aaron Exp $ +.\" $OpenBSD: printf.1,v 1.13 2001/02/17 17:15:27 pjanzen Exp $ .\" .\" Copyright (c) 1989, 1990 The Regents of the University of California. .\" All rights reserved. @@ -317,13 +317,13 @@ command appeared in .Bx 4.3 Reno . .Sh CAVEATS -It is important to never pass a string with user-supplied data as a +It is important never to pass a string with user-supplied data as a format without using .Ql %s . An attacker can put format specifiers in the string to mangle your stack, leading to a possible security hole. .Pp -Be sure to always use the proper secure idiom: +Always be sure to use the proper secure idiom: .Bd -literal -offset indent printf "%s" "$STRING" .Ed