The formatted IO functions {{fprintf()}}, {{printf()}}, {{sprintf()}}, {{snprintf()}}, {{vfprintf()}}, {{vprintf()}}, {{vsprintf()}}, and {{vsnprintf()}} convert, format, and print their arguments under control of a _format_ string. According to \[[ISO/IEC 9899:1999| AA. References#ISO/IEC 9899-1999 | Programming Languages---C]\]:

The format is a character string, beginning and ending in its initial shift state, if any. The format is composed of zero or more directives: ordinary characters, which are simply copied to the output stream, and conversion specifications, each of which shall result in the fetching of zero or more arguments.

Each conversion specification is introduced by the '%' character followed by the following (in order):

• Zero or more flags (in any order), which modify the meaning of the conversion specification.
• An optional minimum field width.
• An optional precision that gives the minimum number of digits to appear for certain conversion specifiers.
• An optional length modifier that specifies the size of the argument.
• A conversion specifier character that indicates the type of conversion to be applied.

Common mistakes in creating format strings include:

• providing insufficient arguments for the format string
• using invalid conversion specifiers
• using a flag character that is incompatible with the conversion specifier
• using a length modifier that is incompatible with the conversion specifier
• mismatching the argument type and conversion specifier
• using an argument of type other than int for width or precision

The following table summarizes C99-compliant conversion specifiers along with the flag characters (the apostrophe ('), -, +, the space character, and # in columns 2, through 5) and length modifiers (h, hh, l, ll, j, z, t, and L in columns 6 through 13) valid for each specification, and the type of the expected argument. Valid and meaningful combinations of a conversion specification, flag character, and length modifier is denoted by the symbol in the corresponding cell or by the name of the type argument effected by the length modifier. Valid combinations that have no effect are denoted by N/E. Using a combination of a conversion specification, flag character, and length modifier denoted by the symbol or a specification not listed in the table, or an argument of an unexpected type may result in undefined behavior. See undefined behavior 145, 149, 150, 153, and 154 in Annex J of C99.

Legend:

• SPACE – the space (' ') character
• N/E – No Effect
• NTBS – char* argument pointing to a Null-Terminated Byte String
• NTWS – wchar_t* argument pointing to a Null-Terminated Wide character String
• XSI – ISO/IEC 9945-2003 XSI extension

Noncompliant Code Example

Mismatches between arguments and conversion specifications may result in undefined behavior. Many compilers can diagnose type mismatches in formatted output function invocations.

const char *error_msg = "Resource not available to user.";
int error_type = 3;
/* ... */
printf("Error (type %s): %d\n", error_type, error_msg);

Compliant Solution

This compliant solution ensures that the format arguments match their respective format specifications.

const char *error_msg = "Resource not available to user.";
int error_type = 3;
/* ... */
printf("Error (type %d): %s\n", error_type, error_msg);

Noncompliant Code Example

The width and precision arguments to printf() format directives must be of type int. According to C99:

A field width, or precision, or both, may be indicated by an asterisk ('*'). In this case an argument of type int supplies the field width or precision.

Passing them as any other type leads to undefined behavior. In this noncompliant code example, the width and precision are specified using parameters declared to be of size_t type. These are unsigned types that may not be the same size as int.

int print_int(int i, size_t width, size_t prec) {
  int n;

  n = printf("%*.*d", width, prec, i);

  return n;
}

Compliant Solution

In this compliant solution, the field width and precision arguments to printf() format directives are of type int.

int print_int(int i, int width, int prec) {
  int n;

  n = printf("%*.*d", width, prec, i);

  return n;
}

Risk Assessment

In most cases, incorrectly specified format strings will result in abnormal program termination.

Automated Detection

The LDRA tool suite V 7.6.0 can detect violations of this recommendation.

GCC Compiler can detect violations of this recommendation when the -Wformat flag is used.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C++ Secure Coding Standard as FIO00-CPP. Take care when creating format strings.

References

\[[ISO/IEC 9899:1999|AA. References#ISO/IEC 9899-1999]\] Section 7.19.6.1, "The {{fprintf}} function"
\[[MITRE 07|AA. References#MITRE 07]\] [CWE ID 686|http://cwe.mitre.org/data/definitions/686.html], "Function Call With Incorrect Argument Type"

09. Input Output (FIO)      09. Input Output (FIO)