Rather than passing the format string to printf and forcing the
arguments to be (u)intmax_t, partially parse format strings and cast
p1 and p2 to the correct type before running the individual format
though printf. This restructure has a couple motivatations:
- We can skip formats that make no sense (floating point, %n, etc.).
- It is possible to special case the printing of pointers in the CHERI case.
The first case is motivated by a suggestion from the audiance at
one of Kirk's BSDCan talks on exterr to allow userspace to set exterr
status. Allowing arbitrary format strings including %n creates a
write-what-where gadget so we need to not do that.
The second case is motivated by our experinces with CHERI and debugging
mmap issues using a different textual error reporting framework. With
CHERI, pointers are more than integer addresses and it's useful to
include more details. Doing so will follow in a future commit.
When the new code encounters an inappropriate format it simply prints
the format code as is. A diagnostic could be emitted in line (similar
to printf(9) printing "(null)" for a NULL string pointer rather than
crashing, but for now we stick with passing the format through
unprocessed.
Effort: CHERI upstreaming
Sponsored by: Innovate UK