Problem - Kevin Tafuro

Solution
Functions such as the printf( ) family of functions provide a flexible and powerful
way to format data easily. Unfortunately, they can be extremely dangerous as well.
Following the guidelines outlined in the following “Discussion” section will allow
you to easily avert many of the problems with these functions.
Discussion
The printf( ) family of functions—and other functions that use them, such as
syslog( ) on Unix systems—all require an argument that specifies a format, as well
as a variable number of additional arguments that are substituted at various locations
in the format string to produce formatted output. The functions come in two
major varieties:
• Those that output to a file (printf( ) outputs to stdout)
• Those that output to a string
Both can be dangerous, but the latter variety is significantly more so.
The format string is copied, character by character, until a percent (%) symbol is
encountered. The characters that immediately follow the percent symbol determine
what will be output in their place. For each substitution in the format string, the next
argument in the variable argument list is used. Because of the way that variable-sized
argument lists work in C (see Recipe 13.4), the functions assume that the number of
arguments present in the argument list is equal to the number of substitutions
required by the format string. The GCC compiler in particular will recognize calls to
the functions in the printf( ) family, and it will emit warnings if it detects data type
mismatches or an incorrect number of arguments in the variable argument list.
If you adhere to the following guidelines when using the printf( ) family of functions,
you can be reasonably certain that you are using the functions safely:
Beware of the “%n” substitution.
All but one of the substitutions recognized by the printf( ) family of functions
use arguments from the variable argument list as data to be substituted into the
output. The lone exception is “%n”, which writes the number of bytes written to
the output buffer or file into the memory location pointed to by the next argument
in the argument list.
While the “%n” substitution has its place, few programmers are aware of it and
its implications. In particular, if external input is used for the format string, an
attacker can embed a “%n” substitution into the format string to overwrite portions
of the stack. The real problem occurs when all of the arguments in the variable
argument list have been exhausted. Because arguments are passed on the
stack in C, the formatting function will write into the stack.
76 | Chapter 3: Input Validation
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.