##### Page tree
Go to start of banner

# DCL10-C. Maintain the contract between the writer and caller of variadic functions

Variadic functions accept a variable number of arguments but are problematic. Variadic functions define an implicit contract between the function writer and the function user that allows the function to determine the number of arguments passed in any particular invocation. Failure to enforce this contract may result in undefined behavior. See undefined behavior 141 of Appendix J of the C Standard.

## Argument Processing

In the following code example, the variadic function `average()` calculates the average value of the positive integer arguments passed to the function [Seacord 2013]. The function processes arguments until it encounters an argument with the value of `va_eol` (`-1`).

```enum { va_eol = -1 };

unsigned int average(int first, ...) {
unsigned int count = 0;
unsigned int sum = 0;
int i = first;
va_list args;

va_start(args, first);

while (i != va_eol) {
sum += i;
count++;
i = va_arg(args, int);
}

va_end(args);
return(count ? (sum / count) : 0);
}
```

Note that `va_start()` must be called to initialize the argument list and that `va_end()` must be called when finished with a variable argument list.

## Noncompliant Code Example

In this noncompliant code example, the `average()` function is called as follows:

```int avg = average(1, 4, 6, 4, 1);
```

The omission of the `va_eol` terminating value means that the function will continue to process values from the stack until it encounters a `va_eol` by coincidence or an error occurs.

## Compliant Solution

This compliant solution enforces the contract by adding `va_eol` as the final argument:

```int avg = average(1, 4, 6, 4, 1, va_eol);
```

## Noncompliant Code Example

Another common mistake is to use more conversion specifiers than supplied arguments, as shown in this noncompliant code example:

```const char *error_msg = "Resource not available to user.";
/* ... */
printf("Error (%s): %s", error_msg);
```

This code results in nonexistent arguments being processed by the function, potentially leaking information about the process.

## Compliant Solution

This compliant solution matches the number of format specifiers with the number of variable arguments:

```const char *error_msg = "Resource not available to user.";
/* ... */
printf("Error: %s", error_msg);
```

### Argument List Caveats

C functions that accept the variadic primitive `va_list` as an argument pose an additional risk. Calls to `vfprintf()`, `vfscanf()`, `vprintf()`, `vscanf()`, `vsnprintf()`, `vsprintf()`, and `vsscanf()` use the `va_arg()` macro, invalidating the parameterized `va_list`. Consequently, once a `va_list` is passed as an argument to any of these functions, it cannot be used again without a call to `va_end()` followed by a call to `va_start()`.

## Risk Assessment

Incorrectly using a variadic function can result in abnormal program termination or unintended information disclosure.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

DCL10-C

High

Probable

High

P6

L2

### Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

### Automated Detection

Tool

Version

Checker

Description

Astrée
19.04

Supported, but no explicit checker
Klocwork
2018
SV.FMT_STR.PRINT_PARAMS_WRONGNUM.FEW
SV.FMT_STR.PRINT_PARAMS_WRONGNUM.MANY
SV.FMT_STR.SCAN_PARAMS_WRONGNUM.FEW
SV.FMT_STR.SCAN_PARAMS_WRONGNUM.MANY

LDRA tool suite
9.7.1

41 S

Enhanced Enforcement

Parasoft C/C++test

10.4.2

CERT_C-DCL10-aThe number of format specifiers in the format string and the number of corresponding arguments in the invocation of a string formatting function should be equal
Polyspace Bug Finder

R2018a

Format string specifiers and arguments mismatch

MISRA C:2012 Rule 17.1

String specifiers do not match corresponding arguments

The features of <stdarg.h> shall not be used

PRQA QA-C
9.5

0185, 0184

Partially implemented

## Related Guidelines

 ISO/IEC TR 24772:2013 Subprogram Signature Mismatch [OTR] MISRA C:2012 Rule 17.1 (required) MITRE CWE CWE-628, Function call with incorrectly specified arguments

## Bibliography

 [Seacord 2013] Chapter 6, "Formatted Output"

1. Some compilers, such as GCC, offer the ability to annotate variadic functions with one of a few common contracts, including execl-style (arg, arg, arg, NULL) and printf-style (fmt, arg1_from_fmt, arg2_from_fmt). Please consider noting this in the standard and suggesting the use of it if available.

2. "marker" should be "args" since it has nothing to do with the marker as such.

"sum" and the return type should probably be unsigned and the test for a marker should be i >= 0.

Also, #define EOL (-1) // end-of-list marker

1. Tightened up average() function as suggested. As defined, average() would work on any list of positive or negative ints that didn't include -1. But for example purposes, it's easier to restrict the function to positive ints than to handle negative ints (and therefore redesign the -1 sentinel.)

3. We could enforce the contracts of the `printf()` and `scanf()` function families because their contracts are well-known (and some compilers already enforce them). I believe they are enforced by other rules.

Enforcing vararg contracts is generally unenforceable unless the contracts are rigorously defined.

4. In addition to this guideline, I think it would be worthwhile to add at the least the following rules:

1. Use `va_copy` to initialize copies of `va_list` objects (undefined behavior #128 )
2. Pair each invocation of `va_start` and `va_copy` with a corresponding `va_end` in the same function (undefined behavior #131 )