Comment 3 for bug 547016

Revision history for this message
Kees Cook (kees) wrote :

You seem to have a trailing "n" in your format string? i.e. running the attached code results in "TEST=Hellon" for me.

Regardless, this is an invalid format specification. Quoting the printf man page:

       ... There may be no gaps in
       the numbers of arguments specified using '$'; for example, if arguments
       1 and 3 are specified, argument 2 must also be specified somewhere in
       the format string.

In this case the code has skipped 1 through 4. Compile-time cannot check for this since a format string may be dynamically generated. When increasing the optimization level, runtime checks are added.

Why they cannot be skipped, I don't understand. :)