SEARCH
0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Prev | Current Page 335 | Next

Shon Harris, Allen Harper, Chris Eagle, and Jonathan Ness

"Gray Hat Hacking, Second Edition"


As always, the parameters of the printf() function are pushed on the stack in reverse
order as shown in Figure 8-1. The addresses of the parameter variables are used. The
printf() function maintains an internal pointer that starts out pointing to the format
string (or top of the stack frame); then it begins to print characters of the format string to
STDIO (the screen in this case) until it comes upon a special character.
If the % is encountered, the printf() function expects a format token to follow. In
which case, an internal pointer is incremented (toward the bottom of the stack frame) to
grab input for the format token (either a variable or absolute value). Therein lies the
problem: the printf() function has no way of knowing if the correct number of variables
or values were placed on the stack for it to operate. If the programmer is sloppy and does
not supply the correct number of arguments, or if the users are allowed to present their
own format string, the function will happily move down the stack (higher in memory),
grabbing the next value to satisfy the format string requirements. So what we saw in our
previous examples was the printf() function grabbing the next value on the stack and
returning it where the format token required.


Pages:
323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347