3 ms·

If the user can control the formatting string, they can write to pointers stored on the stack. It's important to use printf("%s", str) instead of printf(str).

• rep_lodsb 2y ago
  Useless use of printf; what's wrong with "puts(str)"?
  • shawn_w 2y ago
    puts() adds a newline at the end. gcc will happily turn printf("%s\n", str) into puts(str), though. I've never tested to see if printf("%s", str) becomes the equivalent fputs(str, stdout)