6 ms·

I'm curious about this, didn't know about %n before. What are the common pitfalls and exploits using this enables?

• lights0123 2y ago
  If the user can control the formatting string, they can write to pointers stored on the stack. It's important to use printf("%s", str) instead of printf(str).
  • rep_lodsb 2y ago
    Useless use of printf; what's wrong with "puts(str)"?
    • shawn_w 2y ago
      puts() adds a newline at the end. gcc will happily turn printf("%s\n", str) into puts(str), though. I've never tested to see if printf("%s", str) becomes the equivalent fputs(str, stdout)
• mananaysiempre 2y ago
  You would expect a printf call with a user-controlled format string to be, at worst, an arbitrary read. Thanks to %n, it can be a write as well.