The {%n

Specifier}

%n is the dangerous one: it does not print anything. It writes

the number of characters printed so far to the int* argument.

int count;
printf("hello%n", &count);   /* count becomes 5 */

• Give %n an attacker-controlled pointer ⇒ write to an arbitrary address.
• Control the value by controlling how many bytes were printed before the %n —- width specifiers do this cheaply.
• Size variants avoid printing billions of bytes:
• %n writes 4 bytes (an int).
• %hn writes 2 bytes (a short).
• %hhn writes 1 byte.