2 ms·
for static specifiers, I can see that. but for dynamically constructed format specifiers, especially where arrays to pointers/vargs are in use, is it possible t
by notepad0x90 2y ago
for static specifiers, I can see that. but for dynamically constructed format specifiers, especially where arrays to pointers/vargs are in use, is it possible to have a mitigation for that?
this pseudo-code as an example:
snprintf(fmt,userinputstring,args);
printf(fmt,somearray);
- WalterBright 2y agoYour suspicion is correct, the checks only work when the format string is a literal.