You can do the following experiment:
int main ()
{
Char buffer [255];
Scanf ("% s", buffer;
PRINTF (BUFFER);
Return 1;
}
Enter% D when you enter buffer. You will see there is garbled output. This is because the stack is destroyed. Combined with related articles in the previous jar, you can construct a stack to return the function to any address you want to perform ... very dangerous?