doc: Add section about security.

* gettext-tools/doc/gettext.texi (Security of MO Files): New section.

diff --git a/gettext-tools/doc/gettext.texi b/gettext-tools/doc/gettext.texi
index 48f0142d6339ca0cb6819ca385e907e2133b7fea..0bf2da0da7def82d20c7de7f175b3fdc8a1a77d5 100644 (file)
--- a/gettext-tools/doc/gettext.texi
+++ b/gettext-tools/doc/gettext.texi
@@ -325,6 +325,7 @@ Producing Binary MO Files
 * msgfmt Invocation::           Invoking the @code{msgfmt} Program
 * msgunfmt Invocation::         Invoking the @code{msgunfmt} Program
 * MO Files::                    The Format of GNU MO Files
+* Security of MO Files::        Security considerations around MO Files
 
 The Programmer's View
 
@@ -6918,6 +6919,7 @@ the inclusion of @samp{<gettext-po.h>}.
 * msgfmt Invocation::           Invoking the @code{msgfmt} Program
 * msgunfmt Invocation::         Invoking the @code{msgunfmt} Program
 * MO Files::                    The Format of GNU MO Files
+* Security of MO Files::        Security considerations around MO Files
 @end menu
 
 @node msgfmt Invocation
@@ -7096,6 +7098,21 @@ T + ((N-1)*8)| length & offset (N-1)th translation      |  | | | |
 @end group
 @end example
 
+@node Security of MO Files
+@section Security considerations around MO Files
+
+A @code{.mo} file should be installed with the same write permissions as the program or library to which it belongs.  For instance, if a distribution installs a program (executable) or shared library as owned by @code{root} and not writable by unprivileged users, it should install the @code{.mo} files as owned by @code{root} and not writable by unprivileged users as well.
+
+This is necessary for two reasons:
+@itemize @bullet
+@item
+The code in GNU libintl and GNU libc that interprets the MO files does not defensively check against out-of-range offsets and invalid fields in the @code{.mo} file's header (see @ref{MO Files}).
+@item
+For programming languages like C, the translation of a format string is supposed to consume the same number and the same type of arguments as the untranslated format string.  (Otherwise, the program that makes use of the translation may crash.)
+@end itemize
+
+For these two reasons also, it is recommended that the @code{.mo} files are created through @samp{msgfmt -c}.  The use of @code{msgfmt} will guarantee that the @code{.mo} file is well-formed, and the use of the @code{-c} or @code{--check} option will guarantee the consistency of the translations of format strings.
+
 @node Programmers
 @chapter The Programmer's View