Page History

IO.INJ.FMT
MISC.FMT

Format string injection
Format string

TAINTED_STRING

Can detect violations of this rule when the -Wformat-security flag is used

C4916DF4916, C4917, C4918C++4916, C++4917, C++4918DF4917, DF4918

SV.FMTSTR.GENERIC
SV.TAINTED.FMTSTR

86 D

CERT_C-FIO30-a
CERT_C-FIO30-b
CERT_C-FIO30-c

Avoid calling functions printf/wprintf with only one argument other than string constant
Avoid using functions fprintf/fwprintf with only two parameters, when second parameter is a variable
Never use unfiltered data from an untrusted user as the format parameter

592

Partially supported: reports non-literal format strings

Checks for tainted string format (rule partially covered)

4916, 4917, 4918