61–70 of 84 posts
Earlier quoted context omitted.
GNU's printf specifier language is Turing complete, I believe.
What is up with this thread? These comments are duplicated from the top thread...
Edit: ok, I'm guessing it's a joke about Turing completeness. Loops, you know.
Earlier quoted context omitted.
What is up with this thread? These comments are duplicated from the top thread...
Is it possible that it's a joke based on the material of the OP? Maybe we're trapped in some sort of International Obfuscated Internet Thread Contest... Edit: ok, I'm guessing it's a joke about Turing completeness. Loops, you know.
> Format specifiers can take extra “arguments”. - "%hhn": store the number of bytes written mod 256 to the char pointer ... Oh boy. I'll put that down for my "thing I don't think I wanted to know" of the day.
Perhaps a scanner than I can run against all of github, and then rank results by the number of times that code is exposed on a high value server connected to the internet...?
https://www.ioccc.org/years.html#1993_dgibson
It implements Conway's Game of Life by creating a DSL using the C preprocessor and printf. The output is a program (several initial boards are supplied to bootstrap) which is the input program to be compiled and run to create the next generation. This is the program for a second generation:
LIFE
L _ _ _ _ _
L _ _ O _ _
L _ _ _ O _
L _ O O O _
L _ _ _ _ _
GEN 2 STAT 328960
END
Earlier quoted context omitted.
Be careful, though, you don't want anyone to hack you through printf ;)
In the late 90s, looking for "printf(string)" [0] in the code was a great way to discover remote code execution 0days ;-) [0] should be "printf("%s", string)".
My memory wuftpd was the first big program to suffer from this class of attacks.
Earlier quoted context omitted.
Presumably it needs a loop around it, so it's not Turing-complete by itself?
No need to use a loop around it, printf can take care of that pesky detail for you! To quote [0] (my emphasis): > To achieve full Turing-complete computation, we need a way to loop a format string. This is possible by overwriting the pointer inside printf() that tracks which character in the format string is currently being executed. The attacker is unlucky in that at the time the “%n” format specifier is used, this…
Earlier quoted context omitted.
What is up with this thread? These comments are duplicated from the top thread...
Is it possible that it's a joke based on the material of the OP? Maybe we're trapped in some sort of International Obfuscated Internet Thread Contest... Edit: ok, I'm guessing it's a joke about Turing completeness. Loops, you know.
It's hard to believe that this is the same person with multiple widely-cited ML papers[0]. It's jaw-dropping how talented someone can be. https://scholar.google.com/citations?user=q4qDvAoAAAAJ&hl=en...
Earlier quoted context omitted.
Another interesting factoid is that macOS only supports %n if the format string is located in read-only memory. Per printf(3) on macOS: > For this reason, a format argument containing %n is assumed to be untrustworthy if located in writable memory (i.e. memory with protection PROT_WRITE; see mprotect(2)) and any attempt to use such an argument is fatal. Practically, this means that %n is permitted in literal format s…
Someone should inform The Open Group about this violation of POSIX ;) Another fun fact: glibc does this too, if you compile with -D_FORTIFY_SOURCE=2. However, since Linux lacks the nice vm_region APIs the code opens up /proc/self/maps :/