C: Read more bytes than format string with format string insertion

Question

In the article Using string formatting vulnerabilities, the authors give the following code example, where inputis the unfiltered user input.

char outbuf[512];
char buffer[512];
sprintf (buffer, "ERR Wrong command: %400s", input);
sprintf (outbuf, buffer);

They then explain that by using a special format string as input, they can circumvent the limitation %400s:

"%497d\x3c\xd3\xff\xbf<nops><shellcode>"

This creates a string with a length of 479 characters. However, I cannot find an explanation of how the %479dcircumvention is bypassed %400s. How does this input allow sprintf to write a string longer than 400 characters?

Answer 1

sprintf() outbuf, , sprintf(), "% 497d" 497- char ( , ). 512 char outbuf. , (2nd sprintf()).

Answer 2

, input %, buffer % ( sprintf()), sprintf(), 'buffer, % , outbuf. :

snprintf(outbuf, sizeof(outbuf), "%s", buffer);

strcpy(outbuf, buffer);

snprintf() , .