Leaving it at "crash and don't do it" is enough for a beginner C book.
Mentioning code execution and shell code isn't really in the scope. If he mentions code execution, then it sort of warrants mentioning modern architecture prevent executing data as code, or the code segment is not writable on many architectures...and shell code is basically the op code that your machine executes, and injecting shell code in absence of any protecting mechanism will execute arbitrary code, and in presence of protection mechanism, it will crash.
I think just mentioning shell codes and code execution aren't doing a beginner any good. And explaining it is well out of scope. It's not that this is going to be the end all C book, and as long as the reader sticks to using proper format strings, he is good. If he doesn't, knowing about what might happen isn't doing much good either.
> as the reader sticks to using proper format strings, he is good.
Another important point to mention is that the format string itself should not be user coercible! XCode/LLVM/whatever Apple is using nowadays actually treats non-constant format strings as a compilation error, which is pretty cool.
Mentioning code execution and shell code isn't really in the scope. If he mentions code execution, then it sort of warrants mentioning modern architecture prevent executing data as code, or the code segment is not writable on many architectures...and shell code is basically the op code that your machine executes, and injecting shell code in absence of any protecting mechanism will execute arbitrary code, and in presence of protection mechanism, it will crash.
I think just mentioning shell codes and code execution aren't doing a beginner any good. And explaining it is well out of scope. It's not that this is going to be the end all C book, and as long as the reader sticks to using proper format strings, he is good. If he doesn't, knowing about what might happen isn't doing much good either.