Cyber Security Essentials

134 Cyber seCurity essentiAls

C programming language to accept an unknown number of param-

eters using a va_list structure to store them. Normally, a compiler

will compare the number of parameters that a function accepts to the

function definition to prevent programming mistakes; however, the

printf function and other similar functions accept different numbers

of parameters depending upon the format string itself. Using only one

parameter to printf can create a vulnerability if a user can influence

that parameter. Again, the format parameter can accept many differ-

ent formats such as strings (%s), decimal numbers (%d), or hex values

(%x). A legiti ...