Page History

The variable parameters of a variadic function, that is, those that correspond with the position of the ellipsis, are interpreted by the va_arg() macro. The va_arg() macro is used to extract the next argument from an initialized argument list within the body of a variadic function implementation. The size of each parameter is determined by the specified type. If the type is inconsistent with the corresponding argument, the behavior is undefined and may result in misinterpreted data or an alignment error. (See rule EXP36-C. Do not convert pointers into more strictly aligned pointer types.)

...

• Integer arguments of types ranked lower than int are promoted to int, if int can hold all the values of that type; otherwise, they are promoted to unsigned int (the "integer promotions").
• Arguments of type float are promoted to double.

Noncompliant Code Example (Type Interpretation Error)

The C99 C printf() function is implemented as a variadic function. This noncompliant code example swaps its null-terminated byte string and integer parameters with respect to how they are specified in the format string. Consequently, the integer is interpreted as a pointer to a null-terminated byte string and dereferenced. This will likely cause the program to abnormally terminate. Note that the error_message pointer is likewise interpreted as an integer.

const char *error_msg = "Error occurred";
/* ... */
printf("%s:%d", 15, error_msg);

...

const char *error_msg = "Error occurred";
/* ... */
printf("%d:%s", 15, error_msg);

...

long long a = 1;
const char msg[] = "Default message";
/* ... */
printf("%d %s", a, msg);

...

long long a = 1;
const char msg[] = "Default message";
/* ... */
printf("%lld %s", a, msg);

Noncompliant Code Example (NULL)

Because C99 allows Because the C standard allows NULL to be either an integer constant or a pointer constant, any architecture where int is not the same size as a pointer might present a particular vulnerability with variadic functions. If NULL is defined as an int on such a platform, then sizeof(NULL) != sizeof(void *). Consequently, variadic so variadic functions that accept an argument of pointer type will not correctly promote NULL to the correct size. Consequently, the following code will have undefined behavior:

char* string = NULL;
printf("%s %d\n", string, 1);

...

char* string = NULL;
printf("%s %d\n", (string ? string : "null"), 1);

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this recommendation on the CERT website.

Related Guidelines

ISO/IEC 9899:19992011 Section 6.5.2.2, "Function calls," and Section 7.1516, "Variable arguments"

ISO/IEC TR 24772 "IHN Type system" and "OTR Subprogram Signature Mismatchsignature mismatch"

MISRA Rule 16.1

Bibliography

...