Page History

...

Tool

Version

Checker

Description

Include Page

	CodeSonar_V
	CodeSonar_V

IO.INJ.FMT
MISC.FMT

Format String Injectionstring injection
Format Stringstring

Coverity 6.5 TAINTED_STRING_WARNING Fully implemented

5.0

Include Page

	GCC_V
	GCC_V

Can detect violations of this rule when the -Wformat-security flag is used

Include Page

	Klocwork_V
	Klocwork_V

SV.FMTSTR.GENERIC
SV.TAINTED.FMTSTR

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

86 D

Enhanced Enfordementenforcement

Include Page

	Splint_V
	Splint_V

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

...

CERT Oracle Secure Coding Standard for Java	IDS06-J. Exclude unsanitized user input from format strings
CERT Perl Secure Coding Standard	IDS30-PL. Exclude user input from format strings
ISO/IEC TR 24772:2013	Injection [RST]
ISO/IEC TS 17961:2013	Including tainted or out-of-domain input in a format string [usrfmt]
MITRE CWE	CWE-134, Uncontrolled Format String