From 738cca0ab4b900e2ecdb1ab28bc431fca014e6b0 Mon Sep 17 00:00:00 2001 From: David Lamparter Date: Mon, 1 Feb 2021 17:50:01 +0100 Subject: lib/printf: disable `%n` specifier We don't use `%n` anywhere, so the only purpose it serves is enabling exploits. (I thought about this initially when adding printfrr, but I wasn't sure we don't use `%n` anywhere, and thought I'll check later, and then just forgot it...) Signed-off-by: David Lamparter --- lib/printf/printf-pos.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'lib/printf/printf-pos.c') diff --git a/lib/printf/printf-pos.c b/lib/printf/printf-pos.c index cc03f7ef9a..ac775bea4e 100644 --- a/lib/printf/printf-pos.c +++ b/lib/printf/printf-pos.c @@ -384,6 +384,7 @@ reswitch: switch (ch) { goto error; break; #endif /* !NO_FLOATING_POINT */ +#ifdef DANGEROUS_PERCENT_N case 'n': if (flags & INTMAXT) error = addtype(&types, TP_INTMAXT); @@ -404,6 +405,7 @@ reswitch: switch (ch) { if (error) goto error; continue; /* no output */ +#endif case 'O': flags |= LONGINT; /*FALLTHROUGH*/ @@ -576,6 +578,7 @@ reswitch: switch (ch) { goto error; break; #endif /* !NO_FLOATING_POINT */ +#ifdef DANGEROUS_PERCENT_N case 'n': if (flags & INTMAXT) error = addtype(&types, TP_INTMAXT); @@ -596,6 +599,7 @@ reswitch: switch (ch) { if (error) goto error; continue; /* no output */ +#endif case 'O': flags |= LONGINT; /*FALLTHROUGH*/ -- cgit v1.2.3