3 ms·

Mentioning %n without explaining that it is overwhelmingly used for exploits is a little reckless IMO.

• greiskul 2y ago
  I'm curious about this, didn't know about %n before. What are the common pitfalls and exploits using this enables?
  • lights0123 2y ago
    If the user can control the formatting string, they can write to pointers stored on the stack. It's important to use printf("%s", str) instead of printf(str).
    • rep_lodsb 2y ago
      Useless use of printf; what's wrong with "puts(str)"?
      • shawn_w 2y ago
        puts() adds a newline at the end. gcc will happily turn printf("%s\n", str) into puts(str), though. I've never tested to see if printf("%s", str) becomes the equivalent fputs(str, stdout)
  • mananaysiempre 2y ago
    You would expect a printf call with a user-controlled format string to be, at worst, an arbitrary read. Thanks to %n, it can be a write as well.
• _kst_ 2y ago
  Background: A %n format specifier in a printf call stores the number of characters written so far into a specified variable. For example: #include <stdio.h> int main(void) { int count; printf("%s%n\n", "hello, world", &count); printf("count = %d\n", count); } The output is: hello, world count = 12 %n can be exploited to write data to an arbitrary memory location, but only if the format string is something other than a string literal. %n can be exploited, but it's entirely possible to use it safely.
  • lifthrasiir 2y ago
    I think another problem exposed by %n was that you can't easily compose format strings. Sure, `printf(str)` where `str` is a user input would be easy to detect and can be automatically turned into `printf("%s", str)` with some macro hack, but `printf(fmt, ...)` where `fmt` is composed from multiple partial format strings would be harder to reason.