Hacker News Reader

It's unclear how much stack-smashing is involved here. The "Control Flow Bending" paper clearly requires overwriting pointers internal to printf.

Is this possible without invoking undefined behavior? FWIW the demos just crash with SIGILL on macOS.

View on HN

This works by taking advantage of a format string exploit. It is by definition undefined behavior. It just so happens that this behavior is constant an gives the ability to change the flow of the program. At least in the popular glibc. However if someone were to rewrite how printf works but didn't allow the format string vulnerability, it would still be a valid c compiler.

Reply on news.ycombinator.com