5 ms·
> For the exploitability, it doesn’t echo and the rest of the parameters don’t seem like to be controllable. Thus I don’t think this case is exploitable. It's
by Diggsey 5y ago
> For the exploitability, it doesn’t echo and the rest of the parameters don’t seem like to be controllable. Thus I don’t think this case is exploitable.
It's lucky that `CFStringCreateWithFormatAndArguments` doesn't appear to support format specifiers like `%n` which would allow writes, not just reads...
- totorovirus 5y agoif the function doesn't support %n write, then why did it crash?
- goldenkey 5y ago%s would read from a pointer which may cause a memory violation if the pointer is invalid or not in a readable page.