Add warnings about trusting user-supplied data.

Reviewed by:	ru
Approved by:	murray
Obtained from:	OpenBSD

1 files changed, 14 insertions, 0 deletions

diff --git a/lib/libc/stdio/printf.3 b/lib/libc/stdio/printf.3
index 30b02a6..590c1c0 100644
--- a/lib/libc/stdio/printf.3
+++ b/lib/libc/stdio/printf.3
@@ -664,3 +664,17 @@ For safety, programmers should use the
 .Fn snprintf
 interface instead.
 Unfortunately, this interface is not portable.
+.Pp
+Never pass a string with user-supplied data as a format without using
+.Ql %s .
+An attacker can put format specifiers in the string to mangle your stack,
+leading to a possible security hole.
+This holds true even if the string was built using a function like
+.Fn snprintf ,
+as the resulting string may still contain user-supplied conversion specifiers
+for later interpolation by
+.Fn printf .
+.Pp
+Always use the proper secure idiom:
+.Pp
+.Dl snprintf(buffer, sizeof(buffer), "%s", string);