int bad_format(
    char *fmt)
{
    char     *ptr;
    int       n = 0;

    ptr = fmt;
    while (*ptr != '\0')
        if (*ptr++ == '%') {

            /* line cannot end with percent char */
            if (*ptr == '\0')
                return 1;
            /* '%s', '%S' and '%%' are allowed */
            if (*ptr == 's' || *ptr == 'S' || *ptr == '%')
                ptr++;
            /* %c is allowed (but use only with vdef!) */
            else if (*ptr == 'c') {
                ptr++;
                n = 1;
            }

            /* or else '% 6.2lf' and such are allowed */
            else {
                /* optional padding character */
                if (*ptr == ' ' || *ptr == '+' || *ptr == '-')
                    ptr++;
                /* This should take care of 'm.n' with all three optional */
                while (*ptr >= '0' && *ptr <= '9')
                    ptr++;
                if (*ptr == '.')
                    ptr++;
                while (*ptr >= '0' && *ptr <= '9')
                    ptr++;
                /* Either 'le', 'lf' or 'lg' must follow here */
                if (*ptr++ != 'l')
                    return 1;
                if (*ptr == 'e' || *ptr == 'f' || *ptr == 'g')
                    ptr++;
                else
                    return 1;
                n++;
            }
        }

    return (n != 1);
}
The software uses a function that accepts a format string as an argument, but the format string originates from an external source.