...
Failing to exclude user input from format specifiers may allow an attacker to crash a vulnerable process, view the contents of the stack, view memory content, or write to an arbitrary memory location and consequently execute arbitrary code with the permissions of the vulnerable process.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
FIO30-C | High | Likely | Yes | MediumNo | P18 | L1 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| Supported via stubbing/taint analysis | |||||||
| Axivion Bauhaus Suite |
| CertC-FIO30 | Partially implemented | ||||||
| CodeSonar |
| IO.INJ.FMT | Format string injection | ||||||
| Compass/ROSE | |||||||||
| Coverity |
| TAINTED_STRING | Implemented | ||||||
| Cppcheck Premium |
| premium-cert-fio30-cPartially implemented | |||||||
| GCC |
| Can detect violations of this rule when the | |||||||
| Helix QAC |
| DF4916, DF4917, DF4918 | |||||||
| Klocwork |
| SV.FMTSTR.GENERIC | |||||||
| LDRA tool suite |
| 86 D | Partially Implemented | ||||||
| Parasoft C/C++test |
| CERT_C-FIO30-a | Avoid calling functions printf/wprintf with only one argument other than string constant | ||||||
| PC-lint Plus |
| 592 | Partially supported: reports non-literal format strings | ||||||
| Polyspace Bug Finder |
| CERT C: Rule FIO30-C | Checks for tainted string format (rule partially covered) | ||||||
| PVS-Studio |
| V618 | |||||||
| Splint |
|
...