TLDR: The problem is the `% In`, and specifically the `%n` - when printf sees that, it tries to store data in memory. Failing to do so, it crashes.
I read [1] which someone linked to, and it all seems to make sense. But it doeesn't!
I tried compiling this with gcc 11.2.0:
#include <stdio.h>
int main(void)
{
printf("%99 Invisible", NULL);
return 0;
}
test.c: In function ‘main’:
test.c:5:14: warning: unknown conversion type character ‘ ’ in format [-
Wformat=]
5 | printf("%99 Invisible", NULL);
| ^
test.c:5:10: warning: too many arguments for format [-Wformat-extra-args]
5 | printf("%99 Invisible", NULL);
| ^~~~~~~~~~~~~~~
Removing the cruft and trying plain %In gives a warning, but I guess whoever built the car's radio UI ignores warnings.
I guess it's possible that the system doesn't use a standard-compliant enough C library, so it's printf() implementation does something ... creative with this string.
Anyway, classic case of the lovely foot-gunnery that is %n in the wild! Sorry for all the car owners, of course. :/
EDIT: A commenter pointed out that the above are "just warnings", oops. :) More oops on me for not spelling the freaking title correctly, of course it's "99%" and not "%99" .. .need more coffee, clearly. Sorry.
For people less used to C, the error here more or less seems to boil down to passing an untrusted string as the special "format string" for the printf() function. That function will interpret the contents of the string, and the percent symbol is how its special formatting directives start. Characters following a percent symbol will cause it to do stuff. The proper fix is usally to change
printf(string);
printf("%s", string);
[1] https://github.com/Hamled/mazda-format-string-bug#readme
"99% Invisible" produces the expected result: https://godbolt.org/z/Mc9zPKWdq
<source>:6:12: warning: format string is not a string literal (potentially insecure) [-Wformat-security]Just are just warnings, it builds fine despite them.