Question

Hello I’m quite new to C and in a nutshell I was doing the following as part of my assignment in class:

foo (char *var) {
  printf(var);
}

I was told that this is bad practice and insecure but did not get much detailed information on this by my tutor. I assume that if the string value of var is controllable by the user it may be used to perform a bufferoverflow? How would I properly harden this code? Do I have to limit the str length or something?

Cheers & Thanks!

Answer 1

You should use:

printf("%s", var);

instead. The way you have it, I could enter %s as my input, and printf would read a random piece of memory as it looked for a string to print. That can cause any amount of unexpected behaviour.