Everything about Uncontrolled format string
Type of software vulnerability
Uncontrolled format string is a type of code injection vulnerability discovered around 1989 that can be used in security exploits. Originally thought harmless, format string exploits can be used to crash a program or to execute harmful code. The problem stems from the use of unchecked user input as the format string parameter in certain C functions that perform formatting, such as printf . A malicious user may use the %s and %x format tokens, among others, to print data from the call stack or possibly other locations in memory. One may also write arbitrary data to arbitrary locations using the %n format token, which commands printf and similar functions to write the number of bytes formatted to an address stored on the stack. Wikipedia →
🧠Start here: a 6-step reading path
- Read the overview: Uncontrolled format stringA 5-minute orientation
- Pick up a classic book: The Conspirators HierarchyThe most-reprinted book on the subject
- Go sideways: Przemysław FrasunekA closely related topic
- Go sideways: Secure codingA closely related topic
đź“– Definitions
No dictionary entry for this exact phrase.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
- No matching papers found.
đź“š Books worth reading
The Conspirators HierarchyJohn Coleman · 1992
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
đź”— Related topics
- Przemysław Frasunek Przemysław Frasunek (also known as venglin, born 6 May 1983) is a "white hat" hacker from Poland. He has been a frequent Bugtraq poster since late in the…
- Secure coding Secure coding is the practice of developing computer software in such a way that guards against the accidental introduction of security vulnerabilities…
- Code injection Code injection is a computer security exploit where a program fails to correctly process external data, such as user input, causing it to interpret the…
- Defensive programming Defensive programming is a form of defensive design intended to develop programs that are capable of detecting potential security abnormalities and make…
- Printf printf is a C standard library function and is also a Linux terminal (shell) command that formats text and writes it to standard output. The function accepts…
- Stack buffer overflow In software, a stack buffer overflow or stack buffer overrun occurs when a program writes to a memory address on the program's call stack outside of the…
- Buffer overflow In programming and information security, a buffer overflow or buffer overrun is a bug whereby a program writes data to a buffer beyond the buffer's allocated…
- Scanf scanf, short for scan formatted, is a C standard library function that reads and parses text from standard input. The function accepts a format string…