C format string vulnerability: How many bytes does %x read from the stack?

Question

my doubt is the following: assuming Ubuntu 14.04 32bit and x_86 intel atom cpu how many bytes does the format %x read from stack? I know that I can read what's in the stack by using:

formatstring="%x";
printf(formatstring);

As I put more %x in the formatstring, more data are read from the stack. Since %x takes 4 bytes, every %x should read 4 bytes from the stack, so for example if the 1st %x read what's written at the address 0x0 the 2nd will read what's at address 0x4 and so on.. (obviously the numbers are just for me to make the explanation easier). Is this assumption correct? It seems not since when I tried in an exercise to calculate the address of a var doing known_address + (numberof %x untill_the_var_value_is_printed )* 4 I found a wrong address.

Answer 1

As far as the C standard is concerned, the question is not meaningful.

A %x format specifier requires a corresponding argument of type unsigned int. (unsigned int and int are more or less interchangeable as arguments, as long as the value is within the representable range of both types.) The standard doesn't explicitly say so, but it doesn't define the behavior.

If a particular compiler generates code that passes unsigned int arguments to variadic functions on the stack (a term the C standard doesn't use), then printf might read sizeof (unsigned int) bytes from the stack for each %x specifier. On other implementations, it might attempt to read arguments from registers, or from somewhere else. Also, sizeof (unsigned int) can vary from one implementation to another. In principle, it could even vary with compile-time optimization levels.

If you want to know about how something like printf("%x") will actually behave, you'll need to specify the particular implementation you're using, both the target OS and hardware and the compiler you're using. "32-bit Linux" is not nearly specific enough. Since C implementations are not required to document this, it might be difficult to get the details.