zeromq/zproto — pull request #179 by miska (2014-12-02 07:41:02+00:00)
Title: Problem: encoding message with string uses printf

This might actually have some security implications if people using the
library are not avare of this and missuse _encode function. With _encode
function one can construct whole message in one go. Tricky part is that
if it contains string, there is no way to pass additional argument, so
one would expect that contrary to _set method, string is not passed
through printf function. Contrary is true and thus one can for example
call _encode(1, "%s %s") which will try to access not existing arguments
for printf as encode calls _set function.

Solution: Use _set("%s", str) in _encode.