On Tue, Jul 06, 2021 at 01:33:45AM +0900, Masahiro Yamada wrote:
> On Sat, Jul 3, 2021 at 8:21 PM Alexey Dobriyan <adobriyan@xxxxxxxxx> wrote:
> >
> > Compiling "printf("");" doesn't necessarily check for linking capability
> > as printf can be optimised for constants strings even at -O0:
> >
> > 0000000000401106 <main>:
> > 401106: push rbp
> > 401107: mov rbp,rsp
> > 40110a: mov eax,0x0
> > 40110f: pop rbp
> > 401110: ret
> >
> > Pass something from the command line to disable optimisations:
> >
> > 0000000000401126 <main>:
> > 401126: push rbp
> > 401127: mov rbp,rsp
> > 40112a: sub rsp,0x10
> > 40112e: mov DWORD PTR [rbp-0x4],edi
> > 401131: mov QWORD PTR [rbp-0x10],rsi
> > 401135: mov rax,QWORD PTR [rbp-0x10]
> > 401139: add rax,0x8
> > 40113d: mov rax,QWORD PTR [rax]
> > 401140: mov rdi,rax
> > 401143: mov eax,0x0
> > 401148: *** call 401030 <printf@plt>
> > 40114d: mov eax,0x0
> > 401152: leave
> > 401153: ret
> >
> > Signed-off-by: Alexey Dobriyan <adobriyan@xxxxxxxxx>
> > ---
> >
> > scripts/cc-can-link.sh | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > --- a/scripts/cc-can-link.sh
> > +++ b/scripts/cc-can-link.sh
> > @@ -3,9 +3,9 @@
> >
> > cat << "END" | $@ -x c - -o /dev/null >/dev/null 2>&1
> > #include <stdio.h>
> > -int main(void)
> > +int main(int argc, char *argv[])
> > {
> > - printf("");
> > + printf(argv[1]);
> > return 0;
> > }
> > END
>
> Ah, right.
>
> But, we should not merge a bad coding example.
>
> argv[1] may contain '%' format string, and
> recent GCC versions warn about it.
>
>
>
> $ cat test.c
> #include <stdio.h>
>
> int main(int argc, char *argv[])
> {
> printf(argv[1]);
> return 0;
> }
> $ gcc -c -o test.o test.c
> test.c: In function ‘main’:
> test.c:5:5: warning: format not a string literal and no format
> arguments [-Wformat-security]
> 5 | printf(argv[1]);
> | ^~~~~~
> I think replacing printf("") with printf("a")
> (or any string you like)
> is enough.
I get putchar() for "a". puts(argv[1]) works too.
I think argv[1] should be used to defeat optimisers, current and future.
