Multiple choice technology security

What is the vulnerability in this code? 

    char output[20];  
    /*   Assume data is a character array with value %200d asdf   */  
    sprintf(output, data);

  1. Buffer overflow

  2. Off by one error

  3. Format string vulnerability

  4. No vulnerabilities are present in this code
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The code passes data directly as the format string to sprintf. If data contains format specifiers like %200d, sprintf will interpret them as format directives rather than literal text. Attackers can supply malicious format strings like %n to write arbitrary values to memory, leading to code execution. This is a format string vulnerability, not a buffer overflow.

AI explanation

sprintf(output, data) passes user-controlled data directly as the format string argument instead of as a data argument, so if data contains format specifiers like %200d, sprintf will interpret them as formatting directives (here, printing a 200-character-wide field) rather than treating them as literal text. This is a classic format string vulnerability, which can be used to read stack memory or, with %n, even write to memory.

Keep practicing — related questions