/* How well do you know your format specified buffer building friend? * Tested on RHEL 4 with gcc 3.4.3, glibc 2.3.4, 2.6.9-5.EL kernel * Thanks to Andrew Ryder for catching my typo in an earlier version of this code * satebackire */ #include #include int main(int argc, char **argv){ char a[32]; /* Uncomment each sprintf line and test it out */ //sprintf(a, "%20.10s", argv[1]); //Prints 20 bytes every time, NO overflow //sprintf(a, "%.20s", argv[1]); //Prints up to 20 bytes, NO overflow //sprintf(a, "%.30s %.30s", argv[1], argv[1]);//Prints up to 61 bytes, CAN overflow buffer 'a' //sprintf(a, "%10.60s", argv[1]); //Prints up to 60 bytes, CAN overflow buffer 'a' //sprintf(a, "%.*s", strlen(argv[1]), argv[1]); //Prints user specified number of bytes, CAN overflow buffer 'a' //sprintf(a, "%20s", argv[1]); //Prints at least 20 bytes, CAN overflow buffer 'a' //sprintf(a, "%120.10s", argv[1]); //Prints 120 bytes every time, WILL overflow buffer 'a' printf( "a=[%s][%d]\n", a, strlen(a)); return 0; }