Lets say that:
char name[50]="TEST";
printf("%s",name);
Here in the code, the %s
just says that the variable is a string. But why when we print out user inputs, the %s
suddenly change meaning? What's the difference between the user inputting %s
and the program printing out %s
? Even if the user inputs "%s"
, the %s
still doesn't have the same meaning. So how did the user input got validated as a command, and it is possible to do the "vulnerability" inside the program? For example, if the user inputs %x
, the program will print out information on the stack. Is it possible to do this within the program itself?