int bad_format_imginfo(
    char *fmt)
{
    char     *ptr;
    int       n = 0;

    ptr = fmt;
    while (*ptr != '\0')
        if (*ptr++ == '%') {

            /* line cannot end with percent char */
            if (*ptr == '\0')
                return 1;
            /* '%%' is allowed */
            if (*ptr == '%')
                ptr++;
            /* '%s', '%S' are allowed */
            else if (*ptr == 's' || *ptr == 'S') {
                n = 1;
                ptr++;
            }

            /* or else '% 4lu' and such are allowed */
            else {
                /* optional padding character */
                if (*ptr == ' ')
                    ptr++;
                /* This should take care of 'm' */
                while (*ptr >= '0' && *ptr <= '9')
                    ptr++;
                /* 'lu' must follow here */
                if (*ptr++ != 'l')
                    return 1;
                if (*ptr == 'u')
                    ptr++;
                else
                    return 1;
                n++;
            }
        }

    return (n != 3);
}
The software uses a function that accepts a format string as an argument, but the format string originates from an external source.