Talk:Uncontrolled format string

Computer Security: Computing Low‑importance

This article is within the scope of WikiProject Computer Security, a collaborative effort to improve the coverage of computer security on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.Computer SecurityWikipedia:WikiProject Computer SecurityTemplate:WikiProject Computer SecurityComputer Security articles

Low

This article has been rated as Low-importance on the project's importance scale.

This article is supported by WikiProject Computing.

Things you can help WikiProject Computer Security with:

Article alerts will be generated shortly by AAlertBot. Please allow some days for processing. More information...

Answer question about Same-origin_policy
Review importance and quality of existing articles
Identify categories related to Computer Security
Tag related articles
Identify articles for creation (see also: Article requests)
Identify articles for improvement
Create the Project Navigation Box including lists of adopted articles, requested articles, reviewed articles, etc.
Find editors who have shown interest in this subject and ask them to take a look here.

Broken links[edit]

I removed four broken links to format string papers and sites. If anyone has links to valid ones again, especially from trusted referenceable sources please add them. Kimos 03:46, 7 April 2006 (UTC)[reply]

C doesn't pop[edit]

C doesn't pop the arguments. Neither the assembly written library funktions, nor user written C funktions pop the arguments. User written assembly funktions doing this are possible, but it's safe to assume anybody who knows assembly is aware of the danger of messing with the stack. Instead C acesses the arguments with a pointer.

A standard C call looks like this :

; Caller
...
push last argument
...
push first argument
call funktion
add sp,argument size
...

; Funktion
funktion proc near
push bp
mov bp,sp ; arguments can now be acessed by [bp+adress]
...
pop bp
ret
funktion endp

In partikular, you cannot cause trouble by passing a wrong number of arguments (what would be devastating in BASIC or Pascal). Interestingly, the Windows API, what normally uses Pascal-calls uses C-calls for Vararg funktions, for exaclty that reason. Most printf related bugs print mearly garbage. By passing many %X or %s you get a dump of the stack or strings, that is only rarely a hazard. You might get acess to sensitive data, but this requires a lot of knowledge about the programm, and apropriate data structures. The most damaging possible is, to overwrite the code at the return adress with %n, what crashes the programm, but is probably insuficient to jump to malware. --79.200.87.213 (talk) 23:48, 6 February 2015 (UTC)[reply]