The Root Cause

The printf family takes a format string plus variadic arguments.

The format string itself decides how many arguments are consumed.

/* VULNERABLE: user controls the format string */
printf(user_input);

/* SAFE: user data is only a %s argument */
printf("%s", user_input);

• If user_input contains %x or %n, printf will act on them —- reading (or writing) memory that was never passed as an argument.
• The compiler cannot tell the difference at the call site unless it can see the literal string.