lib: Fix %n detection in printf_format_fix_noalloc()

It's undefined how flags, precision or length modifiers are handled with %n,
so make sure we catch all of them to detect an unwanted %n.

diff --git a/src/lib/printf-format-fix.c b/src/lib/printf-format-fix.c
index da1b164244fe238f6a87667ac40dd6847d34c878..64513d198eb4eea1939ef5da8b07041ffa5c914f 100644 (file)
--- a/src/lib/printf-format-fix.c
+++ b/src/lib/printf-format-fix.c
@@ -35,11 +35,14 @@ fix_format_real(const char *fmt, const char *p, size_t *len_r)
 static const char *
 printf_format_fix_noalloc(const char *format, size_t *len_r)
 {
+       static const char *printf_skip_chars = "# -+'I.*0123456789hlLjzt";
        const char *ret, *p, *p2;
 
        p = ret = format;
        while ((p2 = strchr(p, '%')) != NULL) {
                p = p2+1;
+               while (*p != '\0' && strchr(printf_skip_chars, *p) != NULL)
+                       p++;
                switch (*p) {
                case 'n':
                        i_panic("%%n modifier used");

diff --git a/src/lib/test-printf-format-fix.c b/src/lib/test-printf-format-fix.c
index f5642f5140ba6ab6bdbc9aa9c058ddc829f8bc15..e0099fb31cbd046a27949fc8dc1f966e7b0143ad 100644 (file)
--- a/src/lib/test-printf-format-fix.c
+++ b/src/lib/test-printf-format-fix.c
@@ -99,6 +99,7 @@ enum fatal_test_state fatal_printf_format_fix(unsigned int stage)
 {
        static const char *fatals[] = {
                "no no no %n's",
+               "no no no %-1234567890123n's with extra stuff",
                "%m allowed once, but not twice: %m",
                "%m must not obscure a later %n",
                "definitely can't have a tailing %",