6 ms·

Fun fact about %n: Mazda cars used to have a bug where they used printf(str) instead of printf("%s", str) and their media system would crash if you tried to pl

by ufo 4y ago

Fun fact about %n: Mazda cars used to have a bug where they used printf(str) instead of printf("%s", str) and their media system would crash if you tried to play the "99% Invisible" podcast in them. All because the "% In" was parsed as a "%n" with some extra modifiers. https://99percentinvisible.org/episode/the-roman-mars-mazda-virus/ https://99percentinvisible.org/episode/the-roman-mars-mazda-...

rerdavies 4y ago
Fun fact about %n: The %n functionality also makes printf accidentally Turing-complete even with a well-formed set of arguments. A game of tic-tac-toe written in the format string is a winner of the 27th IOCCC. - sez wiki. A not so fun fact: Because the %n format is inherently insecure, it's disabled by default. - MSVC reference.
- charcircuit 4y ago
  >The %n functionality also makes printf accidentally Turing-complete No it doesn't. Printf has no way to loop so it's not Turing complete. Even if you did what the IOCCC entry did with putting it into a loop it still wouldn't be Turing complete as it would not have an infinite memory.
  - webstrand 4y ago
    Nothing real is "Turing complete" if it requires infinite memory. That's a property only abstract machines can have. In common parlance, something is Turing complete if it can compute arbitrary programs that can be computed with M bits of memory, where M is arbitrary but finite.
    - charcircuit 4y ago
      So in common parlance finite state automata are Turing complete? That definition doesn't make any sense.
      - foldr 4y ago
        I'd say they're Turing complete (in common parlance) if they can reasonably viewed as a Turing-complete system that's been hobbled with an arbitrary memory limitation. FSAs generally can't be viewed this way as you can't just "add more memory" to an FSA. By way of contrast, consider a pushdown automaton with two stacks. While any physically real implementation of such a device will necessarily have some kind of limit on the size of the stacks, you can easily see how the device would behave if this limit were somehow removed. It's definitely a bit fuzzy. I'm sure lots of philosophy papers have been written on when exactly it is or isn't appropriate to consider a finite computational system as a finite approximation to a Turing-complete system. In realistic everyday cases, however, it's usually clear enough what should and shouldn't count as such.
        charcircuit 4y ago
        >as you can't just "add more memory" to an FSA. Adding another state to a FSA adds more memory. There is no difference between a hobbled Turing machine and a FSA. Turing machines aren't a useful concept in the real world and that is okay.
        foldr 4y ago
        >Adding another state to a FSA adds more memory. Yes, but it also changes the state transition logic. You can't just 'add 100 more states' to an FSA in the same way that you can 'add 100 more stack slots' to a bounded pushdown automaton. As I said previously, these are somewhat fuzzy distinctions, and I'm not saying that they're easy to make mathematically precise. They do however seem clear enough in most cases of practical interest. There are many real-world computing systems that would be Turing-complete if they had unbounded memory. There are others that are not Turing-complete for more fundamental reasons than memory limitations. Again, I acknowledge that 'more fundamental' is not a mathematically precise concept.
      - mjburgess 4y ago
        https://en.wikipedia.org/wiki/Turing_completeness#Non-mathematical_usage https://en.wikipedia.org/wiki/Turing_completeness#Non-mathem...
  - billpg 4y ago
    My laptop with its finite RAM isn't Turing Complete? Wow.
tom_ 4y ago
"format not a string literal" is one warning I always upgrade to an error. Dear reader: you should do this, too!
- wrigby 4y ago
  Thanks! This prompted me to look up the flag to enable this. For GCC it’s: -Werror=format-security
  - fay59 4y ago
    The flag is -Wformat-nonliteral or -Wformat=2. -Wformat-security only includes a weaker variant that will warn if you pass a variable and no arguments to printf.
- Gigachad 4y ago
  Why are these not compiler errors by default? Opting in to such important safety features seems like broken design.
  - tedunangst 4y ago
    There's more than one compiler.
  - Conscat 4y ago
    How could that really work? printf is a library function, not an intrinsic. A function named printf can do anything your heart desires.
    - ladberg 4y ago
      Depends on the compiler, but you'd mark the printf function with something like: __attribute__((format(printf, 1, 2)))
    - account42 4y ago
      It's a standard library function meaning the compiler can assume that it follows the standard. Specifically for GCC [0]: > The ISO C90 functions abort, abs, acos, asin, atan2, atan, calloc, ceil, cosh, cos, exit, exp, fabs, floor, fmod, fprintf, fputs, free, frexp, fscanf, isalnum, isalpha, iscntrl, isdigit, isgraph, islower, isprint, ispunct, isspace, isupper, isxdigit, tolower, toupper, labs, ldexp, log10, log, malloc, memchr, memcmp, memcpy, memset, modf, pow, printf, putchar, puts, realloc, scanf, sinh, sin, snprintf, sprintf, sqrt, sscanf, strcat, strchr, strcmp, strcpy, strcspn, strlen, strncat, strncmp, strncpy, strpbrk, strrchr, strspn, strstr, tanh, tan, vfprintf, vprintf and vsprintf are all recognized as built-in functions unless -fno-builtin is specified (or -fno-builtin-function is specified for an individual function). Builtin here doesn't mean that GCC won't ever emit calls to library functions, only that it reserves not to and allows itselfs to make assumptions about how the functions work, including diagnosing misuse. The library functions themselves might also be marked with __attribute__(format(...)) as the sibling comment notes but that is not necessarily required for GCC to check the format strings. [0] https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html
deleted 4y ago
[deleted]
gdprrrr 4y ago
Also iPhones had a RCE uaing a WiFi Name that contained %s https://thehackernews.com/2021/07/turns-out-that-low-risk-ios-wi-fi.html https://thehackernews.com/2021/07/turns-out-that-low-risk-io...
- saagarjha 4y ago
  %@.
GolangProject 4y ago
This is one of those annoying little problems that is easily picked up by the vet command (https://pkg.go.dev/cmd/vet https://pkg.go.dev/cmd/vet) when writing Go code. There are, of course, many linters that do the same thing in C, but it's nice to have an authoritative one built in as part of the official Go toolchain, so everyone's code undergoes the same basic checks.

by ufo 4y ago

rerdavies 4y ago

Fun fact about %n: The %n functionality also makes printf accidentally Turing-complete even with a well-formed set of arguments. A game of tic-tac-toe written in the format string is a winner of the 27th IOCCC. - sez wiki. A not so fun fact: Because the %n format is inherently insecure, it's disabled by default. - MSVC reference.

charcircuit 4y ago
>The %n functionality also makes printf accidentally Turing-complete No it doesn't. Printf has no way to loop so it's not Turing complete. Even if you did what the IOCCC entry did with putting it into a loop it still wouldn't be Turing complete as it would not have an infinite memory.
- webstrand 4y ago
  Nothing real is "Turing complete" if it requires infinite memory. That's a property only abstract machines can have. In common parlance, something is Turing complete if it can compute arbitrary programs that can be computed with M bits of memory, where M is arbitrary but finite.
  - charcircuit 4y ago
    So in common parlance finite state automata are Turing complete? That definition doesn't make any sense.
    - foldr 4y ago
      I'd say they're Turing complete (in common parlance) if they can reasonably viewed as a Turing-complete system that's been hobbled with an arbitrary memory limitation. FSAs generally can't be viewed this way as you can't just "add more memory" to an FSA. By way of contrast, consider a pushdown automaton with two stacks. While any physically real implementation of such a device will necessarily have some kind of limit on the size of the stacks, you can easily see how the device would behave if this limit were somehow removed. It's definitely a bit fuzzy. I'm sure lots of philosophy papers have been written on when exactly it is or isn't appropriate to consider a finite computational system as a finite approximation to a Turing-complete system. In realistic everyday cases, however, it's usually clear enough what should and shouldn't count as such.
      - charcircuit 4y ago
        >as you can't just "add more memory" to an FSA. Adding another state to a FSA adds more memory. There is no difference between a hobbled Turing machine and a FSA. Turing machines aren't a useful concept in the real world and that is okay.
        foldr 4y ago
        >Adding another state to a FSA adds more memory. Yes, but it also changes the state transition logic. You can't just 'add 100 more states' to an FSA in the same way that you can 'add 100 more stack slots' to a bounded pushdown automaton. As I said previously, these are somewhat fuzzy distinctions, and I'm not saying that they're easy to make mathematically precise. They do however seem clear enough in most cases of practical interest. There are many real-world computing systems that would be Turing-complete if they had unbounded memory. There are others that are not Turing-complete for more fundamental reasons than memory limitations. Again, I acknowledge that 'more fundamental' is not a mathematically precise concept.
    - mjburgess 4y ago
      https://en.wikipedia.org/wiki/Turing_completeness#Non-mathematical_usage https://en.wikipedia.org/wiki/Turing_completeness#Non-mathem...
- billpg 4y ago
  My laptop with its finite RAM isn't Turing Complete? Wow.

tom_ 4y ago

"format not a string literal" is one warning I always upgrade to an error. Dear reader: you should do this, too!

wrigby 4y ago
Thanks! This prompted me to look up the flag to enable this. For GCC it’s: -Werror=format-security
- fay59 4y ago
  The flag is -Wformat-nonliteral or -Wformat=2. -Wformat-security only includes a weaker variant that will warn if you pass a variable and no arguments to printf.
Gigachad 4y ago
Why are these not compiler errors by default? Opting in to such important safety features seems like broken design.
- tedunangst 4y ago
  There's more than one compiler.
- Conscat 4y ago
  How could that really work? printf is a library function, not an intrinsic. A function named printf can do anything your heart desires.
  - ladberg 4y ago
    Depends on the compiler, but you'd mark the printf function with something like: __attribute__((format(printf, 1, 2)))
  - account42 4y ago
    It's a standard library function meaning the compiler can assume that it follows the standard. Specifically for GCC [0]: > The ISO C90 functions abort, abs, acos, asin, atan2, atan, calloc, ceil, cosh, cos, exit, exp, fabs, floor, fmod, fprintf, fputs, free, frexp, fscanf, isalnum, isalpha, iscntrl, isdigit, isgraph, islower, isprint, ispunct, isspace, isupper, isxdigit, tolower, toupper, labs, ldexp, log10, log, malloc, memchr, memcmp, memcpy, memset, modf, pow, printf, putchar, puts, realloc, scanf, sinh, sin, snprintf, sprintf, sqrt, sscanf, strcat, strchr, strcmp, strcpy, strcspn, strlen, strncat, strncmp, strncpy, strpbrk, strrchr, strspn, strstr, tanh, tan, vfprintf, vprintf and vsprintf are all recognized as built-in functions unless -fno-builtin is specified (or -fno-builtin-function is specified for an individual function). Builtin here doesn't mean that GCC won't ever emit calls to library functions, only that it reserves not to and allows itselfs to make assumptions about how the functions work, including diagnosing misuse. The library functions themselves might also be marked with __attribute__(format(...)) as the sibling comment notes but that is not necessarily required for GCC to check the format strings. [0] https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html

deleted 4y ago

[deleted]

gdprrrr 4y ago

Also iPhones had a RCE uaing a WiFi Name that contained %s https://thehackernews.com/2021/07/turns-out-that-low-risk-ios-wi-fi.html https://thehackernews.com/2021/07/turns-out-that-low-risk-io...

saagarjha 4y ago
%@.

GolangProject 4y ago

This is one of those annoying little problems that is easily picked up by the vet command (https://pkg.go.dev/cmd/vet https://pkg.go.dev/cmd/vet) when writing Go code. There are, of course, many linters that do the same thing in C, but it's nice to have an authoritative one built in as part of the official Go toolchain, so everyone's code undergoes the same basic checks.