4 ms·
Why is %d used to interpolate an integer into a format string? I don't recall seeing this done for any reason before. I hope Zed actually covers how dangerous
by getsat 15y ago
Why is %d used to interpolate an integer into a format string? I don't recall seeing this done for any reason before.
I hope Zed actually covers how dangerous format strings can be if not handled properly. Format strings are still (hilariously) one of the major exploitation vectors in C-based applications today.
Edit: According to Wikipedia, %i and %d are synonymous. Sorry for the confusion.
- zedshaw 15y agoIt's not for the type, but for the output. The 'd' means "decimal" output. For example, you can do %x to "hexadecimal" output, and %o for octal. Of course, there's some complex interplay with what type you hand that function. As for how "dangerous" it is, yeah it's not going to rape your family, it'll just crash. So I'll be showing people how to prevent it.
- kingkilr 15y ago> it's not going to rape your family, it'll just crash Well, if it hits undefined behavior it could in fact rape your family, the standard allows for that.
- zedshaw 15y agoOh right, I forgot they added that to the C6.283185307179586 standard.
- kingkilr 15y agoWell, undefined means the compiler is able to generate any code it pleases, includig, but not limited to, segfaulting, invoking NetHack, or raping your family.
- __rkaup__ 15y agoI'm amused you took the time to put in 2pi there.
- scorpion032 15y agoGoogle bid pi billion for the patents. Intelligent people support Tau: http://tauday.com/ http://tauday.com/ This is the least Zed could do.
- zedshaw 15y agoI put tau in there, get it right.
- getsat 15y agoIt'll crash and potentially allow code execution if the rest of the args are user coercible. Check out the first few chapters of The Shellcoder's Handbook for examples. Thanks for the explanation. I've never seen/had to use %d with integers. I've only used it with %.Nd for floats/doubles.
- irahul 15y agoLeaving it at "crash and don't do it" is enough for a beginner C book. Mentioning code execution and shell code isn't really in the scope. If he mentions code execution, then it sort of warrants mentioning modern architecture prevent executing data as code, or the code segment is not writable on many architectures...and shell code is basically the op code that your machine executes, and injecting shell code in absence of any protecting mechanism will execute arbitrary code, and in presence of protection mechanism, it will crash. I think just mentioning shell codes and code execution aren't doing a beginner any good. And explaining it is well out of scope. It's not that this is going to be the end all C book, and as long as the reader sticks to using proper format strings, he is good. If he doesn't, knowing about what might happen isn't doing much good either.
- getsat 15y ago> as the reader sticks to using proper format strings, he is good. Another important point to mention is that the format string itself should not be user coercible! XCode/LLVM/whatever Apple is using nowadays actually treats non-constant format strings as a compilation error, which is pretty cool.
- zedshaw 15y agocode/ex3.c:6: warning: format ‘%d’ expects type ‘int’, but argument 2 has type ‘double’ You should probably read this book. :-)
- getsat 15y agoHmm, I don't recall MSVC++ ever warning about that! Unfortunately, I did use Windows at one point in my career. I'll pass on reading it since I don't intend to write C ever again, but I hope the book works out well for you. :) Edit: Just dug up some of my old C code. It is indeed %.2f that I was thinking of. Sorry for the confusion once again.
- SamReidHughes 15y agod for decimal?
- getsat 15y agoRight, but I've never seen it used with integers. %.2d is probably the most common format I've seen. Messing up your format strings is a common exploitation vector, so I was wondering if he had typo'd that or otherwise used it accidentally.
- Jach 15y agod is for dinteger, obviously. Edit: Actually, I finally remembered why I always use %d, and why I find seeing %i odd. While %d and %i may be the same for output with printf, they are different for input with scanf. (Also I'm not sure that %i was part of the C89/90 standard for printf, it may have been a compiler specific thing (another reason to avoid); it's defined in C99 but I don't have a copy of the 89/90 pdf.)