The variable parameters of a variadic function—that is, those that correspond with the position of the ellipsis—are interpreted by the
va_arg() macro. The
va_arg() macro is used to extract the next argument from an initialized argument list within the body of a variadic function implementation. The size of each parameter is determined by the specified type. If the type is inconsistent with the corresponding argument, the behavior is undefined and may result in misinterpreted data or an alignment error (see EXP36-C. Do not cast pointers into more strictly aligned pointer types).
The variable arguments to a variadic function are not checked for type by the compiler. As a result, the programmer is responsible for ensuring that they are compatible with the corresponding parameter after the default argument promotions:
- Integer arguments of types ranked lower than
intare promoted to
intcan hold all the values of that type; otherwise, they are promoted to
unsigned int(the integer promotions).
- Arguments of type
floatare promoted to
Noncompliant Code Example (Type Interpretation Error)
printf() function is implemented as a variadic function. This noncompliant code example swaps its null-terminated byte string and integer parameters with respect to how they are specified in the format string. Consequently, the integer is interpreted as a pointer to a null-terminated byte string and dereferenced, which will likely cause the program to abnormally terminate. Note that the
error_message pointer is likewise interpreted as an integer.
Compliant Solution (Type Interpretation Error)
This compliant solution modifies the format string so that the conversion specifiers correspond to the arguments:
As shown, care must be taken to ensure that the arguments passed to a format string function match up with the supplied format string.
Noncompliant Code Example (Type Alignment Error)
In this noncompliant code example, a type
long long integer is incorrectly parsed by the
printf() function with a
%d specifier. This code may result in data truncation or misrepresentation when the value is extracted from the argument list.
long long was not interpreted, if the
long long uses more bytes for storage, the subsequent format specifier
%s is unexpectedly offset, causing unknown data to be used instead of the pointer to the message.
Compliant Solution (Type Alignment Error)
This compliant solution adds the length modifier
ll to the
%d format specifier so that the variadic function parser for
printf() extracts the correct number of bytes from the variable argument list for the
long long argument:
Noncompliant Code Example (
Because the C Standard allows
NULL to be either an integer constant or a pointer constant, any architecture in which
int is not the same size as a pointer might present a particular vulnerability with variadic functions. If
NULL is defined as an
int on such a platform, then
sizeof(NULL) != sizeof(void *), so variadic functions that accept an argument of pointer type will not correctly promote
NULL to the correct size. Consequently, the following code will have undefined behavior:
On a system with 32-bit
int and 64-bit pointers,
printf() may interpret the
NULL as high-order bits of the pointer and the third argument
1 as the low-order bits of the pointer. In this case,
printf() will print a pointer with the value
0x00000001 and then attempt to read an additional argument for the
%d conversion specifier, which was not provided.
Compliant Solution (
This compliant solution avoids sending
Inconsistent typing in variadic functions can result in abnormal program termination or unintended information disclosure.
Does not currently detect violations of this recommendation. Although the recommendation in general cannot be automated, because of the difficulty in enforcing contracts between a variadic function and its invokers, it would be fairly easy to enforce type correctness on arguments to the
Warns about inconsistently typed arguments to formatted output functions when the
|LDRA tool suite||9.7.1|
41 S, 589 S
|Polyspace Bug Finder||R2016a||Format string specifiers and arguments mismatch|
String specifiers do not match corresponding arguments
|ISO/IEC TR 24772:2013||Type System [IHN]|
Subprogram Signature Mismatch [OTR]
|MISRA C:2012||Rule 17.1 (required)|