I am trying to learn about format string bugs and I found the gcc
option -Wformat-security
to raise a warning when a potential format string bug is found. I would like to know if there is a way to evade this check and still have a format bug problem. For example:
#include <stdio.h>
#include <stdlib.h>
int main (int argc, char * argv[])
{
char outbuf[32];
char buffer[32];
if (argc < 2)
{
fprintf (stderr, "Error missing argument!\n");
exit (EXIT_FAILURE);
}
snprintf (buffer, 28, "ERR Wrong command: %8s", argv[1]);
sprintf (outbuf, buffer);
perror(outbuf);
return EXIT_SUCCESS;
}
When compiled in 32bits, it will crash on %21d
input (not on %20d
, but on any number higher than 20). But, the -Wformat-security
will detect it and raise a warning as follow:
$> gcc -m32 -Wall -Wextra -Wformat-security -std=c99 -o fstring fstring.c
fstring.c: In function ‘main’:
fstring.c:19:3: warning: format not a string literal and no format arguments [-Wformat-security]
sprintf (outbuf, buffer);
^
So, is there a way to hide the bug from the warning and still have a possible exploitation ?
Edit: My point is not to correct the bug, but to understand what kind of format string bugs are not captured by this warning. It helps to understand where to look if no warning is raised but potential format string bugs are present.
-Wxxx
flags only affects the warnings that are shown, it does not change the code. What is your problem?