Path: csiph.com!eternal-september.org!feeder.eternal-september.org!reader02.eternal-september.org!.POSTED!not-for-mail
From: Keith Thompson <kst-u@mib.org>
Newsgroups: comp.lang.c
Subject: Re: Counting lines of a file
Date: Wed, 03 Oct 2018 14:59:27 -0700
Organization: None to speak of
Lines: 27
Message-ID: <lntvm24rpc.fsf@kst-u.example.com>
References: <pp0kts$b17$1@dont-email.me> <87o9cbu6xm.fsf@bsb.me.uk> <pp1pce$muk$2@dont-email.me> <87a7nuu4xt.fsf@bsb.me.uk>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Injection-Info: reader02.eternal-september.org; posting-host="8550f27190323af76201106f961d1e2f"; logging-data="15045"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX1/OaPr1wiALtc3D11Do2ZfU"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.1 (gnu/linux)
Cancel-Lock: sha1:AQVFvaQwoXu2fuxVJnXzFV7tYLA= sha1:PhexVg29kRdgg0/HevzPFsm9udI=
Xref: csiph.com comp.lang.c:136147

Ben Bacarisse <ben.usenet@bsb.me.uk> writes:
[...]
> And can you explain what you mean by %n (a scanf directive) being phased
> out for security reasons?  Who is phasing it out and what are the
> security reasons?

%n is also a printf directive.  For example, this:

    printf("hello%n, world\n", &count);

sets count to 5 (the number of characters printed so far).

At least one C runtime library I use (on Android) does not support "%n",
supposedly for security reasons.  But it is not in any way deprecated or
marked as obsolescent by the ISO C standard (or by POSIX).

I *think* the rationale has something to do with user-defined format
strings.

For Android, "%n" support was dropped in response to bug #14492135,
but I haven't found the bug report itself.

-- 
Keith Thompson (The_Other_Keith) kst-u@mib.org  <http://www.ghoti.net/~kst>
Working, but not speaking, for JetHead Development, Inc.
"We must do something.  This is something.  Therefore, we must do this."
    -- Antony Jay and Jonathan Lynn, "Yes Minister"