What will be the output of the program ?
#include <stdio.h>
int main()
{
char *str;
str = "%s";
printf(str, "K\n");
return 0;
}
Answer: C
Correct answer: K
printf takes its format as an ordinary const char * argument, so nothing requires it to be a literal written at the call site. Here str holds "%s", and printf(str, "K\n") uses it exactly as if the literal had been written there.
The output is K followed by a newline. The technique is legal but dangerous in practice: a format string taken from input rather than fixed in the source is the classic format string vulnerability, which is why compilers warn about non-literal formats.
Please log in or register to report this question.