Question: I am making some FAQ accordion. 
I need to **select all but first** `dd` and hide em all.

[fiddle](https://jsfiddle.net/2z1v463x/)
Basically, I want the answer 1 to be shown when the page loads, and I don't want to insert any id or class into html. What is the easiest way to accomplish this

```js
$('dd').hide();
$('dl').on('mouseenter', 'dt', function() {
  $(this).next().slideDown(200);
  $(this).next().siblings('dd').slideUp(200);
});
```

```css
dt {
  background-color: #d464d4;
  padding: 10px;
  font-size: 16px;
  text-align: center;
  cursor: pointer;
}
dd {
  height: 30px;
  line-height: 2;
  text-align: center;
}
```

```html
<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
<dl>
  <dt>FAQ1</dt>
  <dd>Answer 1</dd>
  <dt>FAQ2</dt>
  <dd>Answer 2</dd><dt>FAQ3</dt>
  <dd>Answer 3</dd><dt>FAQ4</dt>
  <dd>Answer 4</dd><dt>FAQ5</dt>
  <dd>Answer 5</dd>
  <dt>FAQ6</dt>
  <dd>Answer 6</dd>
</dl>
```

Answer: 
The code below outputs the contents of `my_file_name` to the standard output:

```
printf("File %s", my_file_name);

```

If `my_file_name` is received from a malicious source and the program outputs to the terminal, it is possible for the malicious source to have put escape sequences in `my_file_name` that tell the terminal to perform non trivial tasks such as sending terminal contents back through standard input. It is difficult but conceivable that an attacker may derive useful information from such an attack or even attempt to corrupt data via executing commands as if they were typed by the user.

Of course the second call invokes undefined behavior as you are not passing a valid string pointer as a second argument to `printf`.

The above scenario is probably not what you are referring to by *buffer overflow vulnerability*. There is no such vulnerability in the `printf` code it self, but is a buffer overflow flaw exists somewhere else in your code, and the actual format string can be patched via this overflow, an attacker can take advantage of `printf`'s capabilities, especially the `%n` format to poke any value to almost any location in the program memory. This is the rationale for removing `%n` in `printf_s` as exposed in a Microsoft security paper.
The first call is fine. (Issues exist when you use a user provided format string, as in `printf(s)`, where s is under the influence of the user. Here you use a hard-coded format string `"File %s"`, which is not vulnerable. The contents of the string `my_file_name` will be treated as a regular C string and just be copied to the standard output. Of course it must be null terminated, and if the output is redirected to something else there can be side effects there, but that's not a printf issue.)

The second call is simply undefined behavior, because the number of parameters after the format string (0) does not match the number which the format string demands (1).