Page History

The formatted IO functions fprintf(), printf(), sprintf(), snprintf(), vfprintf(), vprintf(), vsprintf(), and vsnprintf() convert, format, and print their arguments under control of a format string. Section  Subclause 7.21.6.1 of the C Standard [ISO/IEC 9899:2011] , states:

The format shall be a multibyte character sequence, beginning and ending in its initial shift state. The format is composed of zero or more directives: ordinary multibyte characters (not %), which are copied unchanged to the output stream; and conversion specifications, each of which results in fetching zero or more subsequent arguments, converting them, if applicable, according to the corresponding conversion specifier, and then writing the result to the output stream.

...

The following table summarizes C-compliant conversion specifiers along with the flag characters valid for each specification (the apostrophe ([')], -, +, the space character, and # in columns 2 through 5) and length modifiers (h, hh, l, ll, j, z, t, and L in columns 6 through 13) and the type of the expected argument. Valid and meaningful combinations of a conversion specification, flag character, and length modifier is are denoted by the symbol in the corresponding cell or by the name of the type argument affected by the length modifier. Valid combinations that have no effect are denoted by N/E. Using a combination of a conversion specification, flag character, and length modifier denoted by the symbol or a specification not listed in the table, or using an argument of an unexpected type, may result in undefined behavior. See undefined behaviors 153, 155, 157, 158, 161, and 162 in Annex J of the C Standard.

...

The width and precision arguments to printf() format directives must be of type int. Section Subclause 7.21.6.1 of the C standard Standard [ISO/IEC 9899:2011] , states:

A field width, or precision, or both, may be indicated by an asterisk ('*'). In this case, an argument of type int supplies the field width or precision.

...

In most cases, incorrectly specified format strings will result in abnormal program termination.

Automated Detection

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...