5 ms·

>Format specifiers can take extra “arguments”. - "%hhn": store the number of bytes written mod 256 to the char pointer ... Oh boy. I'll put that down for my "

• rightbyte 6y ago
  There is some innocent beauty in the twistedness of printf - especially with GNU extensions.
  • tomjakubowski 6y ago
    GNU's printf specifier language is Turing complete, I believe.
    • alisonkisk 6y ago
      Theres a great example of what you can do with this, submitted and discussed on HN here: https://news.ycombinator.com/item?id=25690319 https://news.ycombinator.com/item?id=25690319
      • notretarded 6y ago
        >Format specifiers can take extra “arguments”. - "%hhn": store the number of bytes written mod 256 to the char pointer ... Oh boy. I'll put that down for my "thing I don't think I wanted to know" of the day.
        • snerp 6y ago
          There is some innocent beauty in the twistedness of printf - especially with GNU extensions.
          • dfcowell 6y ago
            So I can port doom to gnu printf?
            • kortilla 6y ago
              GNU's printf specifier language is Turing complete, I believe.
              • deleted 6y ago
                [deleted]
              • deleted 6y ago
                [deleted]
            • a1369209993 6y ago
              GNU's printf is Turing complete[0]... so "yes." [0] Mentioned (but not directly linked) by TFA: https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/carlini https://www.usenix.org/conference/usenixsecurity15/technical...
          • SahAssar 6y ago
            GNU's printf specifier language is Turing complete, I believe.
            • gu5 6y ago
              What is up with this thread? These comments are duplicated from the top thread...
              • exikyut 6y ago
                (The usernames are different)
              • dang 6y ago
                Is it possible that it's a joke based on the material of the OP? Maybe we're trapped in some sort of International Obfuscated Internet Thread Contest... Edit: ok, I'm guessing it's a joke about Turing completeness. Loops, you know.
    • FartyMcFarter 6y ago
      Presumably it needs a loop around it, so it's not Turing-complete by itself?
      • moonchild 6y ago
        Not portable, but if you can get the address of the stack you can force printf to overwrite the return address, obviating the loop.
      • shakna 6y ago
        It does not need the loop. It might be easier to understand by looking at something like this. [0] That printf allows for this kind of Turing complete control flow is well known [1]. [0] https://github.com/HexHive/printbf https://github.com/HexHive/printbf [1] http://nebelwelt.net/publications/files/15SEC.pdf http://nebelwelt.net/publications/files/15SEC.pdf
        • moonchild 6y ago
          That code is wrapped in a loop - https://github.com/HexHive/printbf/blob/master/src/pbf_pre.c#L167 https://github.com/HexHive/printbf/blob/master/src/pbf_pre.c...
      • npongratz 6y ago
        No need to use a loop around it, printf can take care of that pesky detail for you! To quote [0] (my emphasis): > To achieve full Turing-complete computation, we need a way to loop a format string. This is possible by overwriting the pointer inside printf() that tracks which character in the format string is currently being executed. The attacker is unlucky in that at the time the “%n” format specifier is used, this value is saved in a register on our 64-bit system. However, we identify one point in time in which the attacker can always mount the attack. The printf() function makes calls to puts() for the static components of the string. When this function call is made, all registers are saved to the stack. It turns out that an attacker can overwrite this pointer from within the puts() function. By doing this, the format string can be looped. > An attacker can cause puts() to overwrite the desired pointer. Prior to printf() calling puts(), the attacker uses “%n” format specifiers to overwrite the stdout FILE object so that the temporary buffer is placed directly on top of the stack where the index pointer will be saved. Then, we print the eight bytes corresponding to the new value we want the pointer to have. Finally, we use more “%n” format specifiers to move the buffer back to some other location so that more unintended data will not be overwritten. [0] https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-carlini.pdf https://www.usenix.org/system/files/conference/usenixsecurit..., Appendix B "Printf is Turing-complete".
  • flatiron 6y ago
    So I can port doom to gnu printf?
    • npongratz 6y ago
      GNU's printf is Turing complete[0]... so "yes." [0] Mentioned (but not directly linked) by TFA: https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/carlini https://www.usenix.org/conference/usenixsecurity15/technical...
      • StavrosK 6y ago
        I've always wanted a Turing-complete printing function.
        • josefx 6y ago
          We already have post script for that.
    • bluGill 6y ago
      I'd start by creating a llvm backend for printf. Should be fun.
    • anthk 6y ago
      Port a zmachine first ;).
    • deleted 6y ago
      [deleted]
• londons_explore 6y ago
  Are there any scanners out there that will detect user input ending up as the format string of a printf? Perhaps a scanner than I can run against all of github, and then rank results by the number of times that code is exposed on a high value server connected to the internet...?
  • Someone 6y ago
    Any modern C compiler will already warn you if the format string isn’t a string literal (https://stackoverflow.com/questions/32362918/error-format-string-is-not-a-string-literal/32362980 https://stackoverflow.com/questions/32362918/error-format-st...) I don’t think it’s worth the effort to extend that to look for tainted strings, not because it wouldn’t be useful, but because it would be hard to do (as an extreme example: is data read from a file user input? It could be a file containing internationalization info) The (relatively) few programs that construct format strings on the fly will have to add pragmas to disable these warnings.