4 ms·

> Looking at old source code, the earliest implementation I found is 4.3BSD Tahoe (1988). You are the HN historian of the day.

wahern 6y ago
Another interesting factoid is that macOS only supports %n if the format string is located in read-only memory. Per printf(3) on macOS: > For this reason, a format argument containing %n is assumed to be untrustworthy if located in writable memory (i.e. memory with protection PROT_WRITE; see mprotect(2)) and any attempt to use such an argument is fatal. Practically, this means that %n is permitted in literal format strings but disallowed in format strings located in normal stack- or heap-allocated memory. The manual page seems correct: % cat test.c #include <stdio.h> int main(void) { printf((char[]){ "%n" }, &(int){ 0 }); return 0; } % cc -o test test.c % ./test zsh: abort ./test
- saagarjha 6y ago
  Someone should inform The Open Group about this violation of POSIX ;) Another fun fact: glibc does this too, if you compile with -D_FORTIFY_SOURCE=2. However, since Linux lacks the nice vm_region APIs the code opens up /proc/self/maps :/
  - astrange 6y ago
    dyld on Darwin has an API to ask if any pointer is to a read-only section of a binary. It’s useful because you can e.g. skip strcpys and other allocations.
    - saagarjha 6y ago
      Hmm, can you tell me more? I can't think of any situation where skipping on a strcpy is legal, since you provide the second buffer and so the copy must occur. And I know that there is heavy uniquing going on for things like selectors and CFStrings at compile time, but where is the dyld API being used at runtime?
      - astrange 6y ago
        Oh, I meant strdup. Look for stdupIfMutable() calls in libobjc.
  - pjmlp 6y ago
    That is the beauty of POSIX, write once, debug everywhere, fix with plenty of spaghetti #ifdefs.

wahern 6y ago

Another interesting factoid is that macOS only supports %n if the format string is located in read-only memory. Per printf(3) on macOS: > For this reason, a format argument containing %n is assumed to be untrustworthy if located in writable memory (i.e. memory with protection PROT_WRITE; see mprotect(2)) and any attempt to use such an argument is fatal. Practically, this means that %n is permitted in literal format strings but disallowed in format strings located in normal stack- or heap-allocated memory. The manual page seems correct: % cat test.c #include <stdio.h> int main(void) { printf((char[]){ "%n" }, &(int){ 0 }); return 0; } % cc -o test test.c % ./test zsh: abort ./test

saagarjha 6y ago
Someone should inform The Open Group about this violation of POSIX ;) Another fun fact: glibc does this too, if you compile with -D_FORTIFY_SOURCE=2. However, since Linux lacks the nice vm_region APIs the code opens up /proc/self/maps :/
- astrange 6y ago
  dyld on Darwin has an API to ask if any pointer is to a read-only section of a binary. It’s useful because you can e.g. skip strcpys and other allocations.
  - saagarjha 6y ago
    Hmm, can you tell me more? I can't think of any situation where skipping on a strcpy is legal, since you provide the second buffer and so the copy must occur. And I know that there is heavy uniquing going on for things like selectors and CFStrings at compile time, but where is the dyld API being used at runtime?
    - astrange 6y ago
      Oh, I meant strdup. Look for stdupIfMutable() calls in libobjc.
- pjmlp 6y ago
  That is the beauty of POSIX, write once, debug everywhere, fix with plenty of spaghetti #ifdefs.