Incorrect conversion specifiers

[steven-bellock]

There are many instances of

libspdm/library/spdm_requester_lib/libspdm_req_challenge.c

Lines 381 to 382 in 11a60b3

	LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO,
	"libspdm_challenge - libspdm_encapsulated_request - %p\n", status));

where status is a uint32_t. If libspdm_debug_print passes this to the C printf function then the behavior is undefined.

If any argument is not the correct type for the corresponding conversion specification, the behavior is undefined.

Most compilers can detect this issue. However the libspdm_debug_print function masks this.

There are a few issues and tasks that arise from this.

1. The conversion specifiers need to be changed. (This issue)
2. The documentation for libspdm_debug_print needs to specify that format and ... follow C printf conventions.
3. For CI/CD the LIBSPDM_DEBUG macro needs to be overridden such that it can be replaced with printf. Then the compiler can detect issues like this during compilation.

Even though this invokes undefined behavior I do not consider it much of a vulnerability, since

• This issue only arises in a debug build.
• For most (all?) compilers the behavior is benign. Most just print the value of the integer.