6 ms·

If you don't write C very often (I don't) and you want to see these things in action: https://microcorruption.com https://microcorruption.com I had no clue pri

• minimax 13y ago
  In this case I don't think they are warning about format string vulnerabilities. The poster mentions sprintf (not printf) so presumably they are warning you about overflowing the destination buffer. I'm also having a super fun time with the microcorruption challenges. Highly recommend.
• meowface 13y ago
  printf (and others in that family of functions) are only exploitable if you do something like `printf(user_controlled_str)` (possibly with extra arguments). Basically, don't let the user control the very first argument (which would allow them to add format specifiers like %d or %x) and you're safe.
  • jere 13y ago
    Well, yea. This is exactly what you do in a few levels of microcorruption. You can always say "dont do X and you'll be fine." But that's kind of like saying "don't point a gun at someone" and the gun will be completely harmless. That's the trick, isn' it? That seems to be the point of the "True bugs wait" site at least. It only takes one mistake.
    • meowface 13y ago
      I agree, especially with things like strcpy and strcat, but printf is kind of a special case because it's a very, very simple rule to follow. Plus most of the time it's illogical to use it without a format specifier (or with user supplied ones).