Page History

...

The C99 printf() function is implemented as a variadic function. This non-compliant code example swaps its null NULL terminated byte string and integer parameters with respect to how they were specified in the format string. Consequently, the integer is interpreted as a pointer to a null NULL terminated byte string and dereferenced. This will likely cause the program to abnormally terminate. Note that the error_message pointer is likewise interpreted as an integer.

char const *error_msg = "Error occurred";
/* // ... */
printf("%s:%d", 15, error_msg);

...

char const *error_msg = "Error occurred";
/* // ... */
printf("%d:%s", 15, error_msg);

...

long long a = 1;
char msg[128] = "Default message";
/* // ... */
printf("%d %s", a, msg);

...

long long a = 1;
char msg[128] = "Default message";
/* // ... */
printf("%lld %s", a, msg);

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899-1999:TC2|AA. C References#ISO/IEC 9899-1999TC2]\] Section 7.15, "Variable arguments"