Re: ncurses 4.1 security bug

[imp () VILLAGE ORG (Warner Losh)]

In message <m0ytvb6-000aQFC () the-village bc nu> Alan Cox writes:
: C++ global object constructors are called in pretty much arbitary
: order before main() is entererd.

That's not entirely correct.  C++ global object constructors need to be
initialized before they are referenced, even if they are in a
dynamically linked in library.  This is traditionally done with a call
to _main() as the first thing in main().

However, that nit-picking aside, you are correct that you cannot
predict when the ctors will be called.

: Its an interesting reason not to write setuid apps in C++ 8)

Or just don't use global objects that have ctors.  It is arguably bad
form anyway :-).  Well, you could use global objects, so long as they
don't need to do privileged things, or carelessly rely on user input..

Warner