Page History

...

In the following code example, the variadic function average() calculates the average value of the positive integer arguments passed to the function [Seacord 2005c2013]. The function processes arguments until it encounters an argument with the value of va_eol (-1).

...

This compliant solution enforces the contract by adding va_eol as the final argument.:

int avg = average(1, 4, 6, 4, 1, va_eol);

...

Another common mistake is to use more conversion specifiers than supplied arguments, as shown in this noncompliant code example.:

const char *error_msg = "Resource not available to user.";
/* ... */
printf("Error (%s): %s", error_msg);

...

This compliant solution matches the number of format specifiers with the number of variable arguments.:

const char *error_msg = "Resource not available to user.";
/* ... */
printf("Error: %s", error_msg);

...

Incorrectly using a variadic function can result in abnormal program termination or unintended information disclosure.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Automated Detection

Related Guidelines

Bibliography

...

Image Modified Image Modified Image Modified