...
Incorrectly using a variadic function can result in abnormal program termination or unintended information disclosure.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
DCL10-C | High | Probable | High | P6 | L2 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Automated Detection
Tool | Version | Checker | Description | ||||
|---|---|---|---|---|---|---|---|
| Astrée |
|
| Supported, but no explicit checker | ||||||||
| Klocwork |
| SV.FMT_STR.PRINT_PARAMS_WRONGNUM.FEW SV.FMT_STR.PRINT_PARAMS_WRONGNUM.MANY SV.FMT_STR.SCAN_PARAMS_WRONGNUM.FEW SV.FMT_STR.SCAN_PARAMS_WRONGNUM.MANY |
| LDRA tool suite |
| 41 S | Enhanced Enforcement | ||||||
| Polyspace Bug Finder |
| String specifiers do not match corresponding arguments The features of <stdarg.h> shall not be used | |||||||
| PRQA QA-C |
| 0185 | Partially implemented |
Related Guidelines
| ISO/IEC TR 24772:2013 | Subprogram Signature Mismatch [OTR] |
| MISRA C:2012 | Rule 17.1 (required) |
| MITRE CWE | CWE-628, Function call with incorrectly specified arguments |
Bibliography
| [Seacord 2013] | Chapter 6, "Formatted Output" |
...