<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">The proposal in Fred’s 10/24 email entails release-to-release incompatible changes, which needs a strong rationale.<div class=""><br class=""></div>Martin Sebor's paper is at <a href="http://www.open-std.org/jtc1/sc22/wg14/www/docs/n2301.htm" class="">http://www.open-std.org/jtc1/sc22/wg14/www/docs/n2301.htm</a>.<br class=""><br class=""><div class="">n-char-sequences are for optional implementation-defined semantics. The current specification was intended to not burden implementations that don’t support the semantics.</div><div class=""><br class=""></div><div class="">Couldn’t the security problem be addressed by limiting the length of any n-char-sequence that might appear in printf output of nan(n-char-sequence), perhaps to the value of an implementation-defined macro? The macro value could be zero if the implementation never printed n-char-sequences.</div><div class=""><br class=""></div><div class="">- Jim Thomas<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Nov 26, 2018, at 8:39 AM, Fred J. Tydeman <<a href="mailto:tydeman@tybor.com" class="">tydeman@tybor.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On Mon, 26 Nov 2018 08:27:15 -0800 Jim Thomas wrote:<br class=""><blockquote type="cite" class=""><br class="">Is this proposal at the request of WG14? If so, what exactly was requested?<br class=""></blockquote><br class="">Not exactly. Martin Sebor presented a paper showing that the output<br class="">of the form NaN(chars) is unbounded, so is a security problem. He<br class="">presented an idea on how to limit that output. The committee did not<br class="">like his idea. So, I decided to come up with my own solution.<br class=""><br class=""><br class=""><br class="">---<br class="">Fred J. Tydeman Tydeman Consulting<br class=""><a href="mailto:tydeman@tybor.com" class="">tydeman@tybor.com</a> Testing, numerics, programming<br class="">+1 (702) 608-6093 Vice-chair of PL22.11 (ANSI "C")<br class="">Sample C99+FPCE tests: <a href="http://www.tybor.com" class="">http://www.tybor.com</a><br class="">Savers sleep well, investors eat well, spenders work forever.<br class=""></div></div></blockquote></div><br class=""></div></body></html>