Hacker News Reader

Comment by saagarjha | Hacker News Reader

Mentioning %n without explaining that it is overwhelmingly used for exploits is a little reckless IMO.

Background: A %n format specifier in a printf call stores the number of characters written so far into a specified variable. For example:

    #include <stdio.h>
    int main(void) {
        int count;
        printf("%s%n\n", "hello, world", &count);
        printf("count = %d\n", count);
    }

The output is:

    hello, world
    count = 12

%n can be exploited to write data to an arbitrary memory location, but only if the format string is something other than a string literal.

%n can be exploited, but it's entirely possible to use it safely.

I think another problem exposed by %n was that you can't easily compose format strings. Sure, `printf(str)` where `str` is a user input would be easy to detect and can be automatically turned into `printf("%s", str)` with some macro hack, but `printf(fmt, ...)` where `fmt` is composed from multiple partial format strings would be harder to reason.

I'm curious about this, didn't know about %n before. What are the common pitfalls and exploits using this enables?

If the user can control the formatting string, they can write to pointers stored on the stack. It's important to use printf("%s", str) instead of printf(str).

Useless use of printf; what's wrong with "puts(str)"?

puts() adds a newline at the end. gcc will happily turn printf("%s\n", str) into puts(str), though.

I've never tested to see if printf("%s", str) becomes the equivalent fputs(str, stdout)

You would expect a printf call with a user-controlled format string to be, at worst, an arbitrary read. Thanks to %n, it can be a write as well.

Reply on news.ycombinator.com