Re: [musl] [PATCH] [RFC] trap on invalid printf formats

[enh <enh@google.com>]

[-- Attachment #1: Type: text/plain, Size: 1358 bytes --]

i really should do this in bionic... currently we only abort on %n (which
is explicitly _not_ supported) or %w with a silly size.

for random junk, we currently do what the BSDs do (since that's where this
code originally came from):

      default: /* "%?" prints ?, unless ? is NUL */
        if (ch == '\0') goto done;
        /* pretend it was %c with argument ch */
        cp = buf;
        *cp = ch;
        size = 1;
        sign = '\0';
        break;

from running a quick test program, macOS and glibc seem to work similarly,
which increases the chances that there's incorrect code out there. (clang
does at least warn "warning: invalid conversion specifier '?'
[-Wformat-invalid-specifier]" by default, though. gcc doesn't.)

On Wed, Jun 21, 2023 at 2:38 PM Rich Felker <dalias@libc.org> wrote:

> Inspired by a new instance of some bitrotted software using %Lu
> instead of %llu, attached is a draft patch to catch such errors rather
> than silently leaving missing output.
>
> I don't know if this is a good idea to actually do (note: probably
> matching changes should be made in wide printf and maybe also scanf if
> so) but I'm posting it here in case anyone wants to experiment or
> discuss. Note that there is no conformance distinction since invalid
> format strings are undefined behavior.
>
> Rich
>

[-- Attachment #2: Type: text/html, Size: 1828 bytes --]