The formatted output functions (fprintf() and related functions) convert, format, and print their arguments under control of a format string. The C Standard, 7.21.6.1, paragraph 3 [ISO/IEC 9899:2011], specifies:
The format shall be a multibyte character sequence, beginning and ending in its initial shift state. The format is composed of zero or more directives: ordinary multibyte characters (not %), which are copied unchanged to the output stream; and conversion specifications, each of which results in fetching zero or more subsequent arguments, converting them, if applicable, according to the corresponding conversion specifier, and then writing the result to the output stream.
...
- Zero or more flags (in any order), which modify the meaning of the conversion specification
- An optional minimum field width
- An optional precision that gives the minimum number of digits to appear for certain conversion specifiers
- An optional length modifier that specifies the size of the argument
- A conversion specifier character that indicates the type of conversion to be applied
...
The following table summarizes the compliance of various conversion specifications. The first column contains one or more conversion specifier characters. The next four columns consider the combination of the specifier characters with the various flags (the apostrophe ['], -, +, the space character, #, and 0). The next eight columns consider the combination of the specifier characters with the various length modifiers (h, hh, l, ll, j, z, t, and L).
Valid combinations are marked with a type name; arguments matched with the conversion specification are interpreted as that type. For example, an argument matched with the specifier %hd is interpreted as a short, so short appears in the cell where d and h intersect. The last column denotes the expected type types of arguments matched with the original specifier characters.
Valid and meaningful combinations are marked by the 
symbol (save for the length modifier columns, as described previously). Valid combinations that have no effect are labeled N/E. Using a combination marked by the 
symbol, using a specification not represented in the table, or using an argument of an unexpected type is undefined behavior. (see See undefined behaviors 153, 155, 157, 158, 161, and 162.).
Conversion |
|
|
|
|
|
|
|
|
|
|
|
| Argument |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
| Signed integer |
|
|
|
|
|
|
|
|
|
|
|
|
| Unsigned integer |
|
|
|
|
|
|
|
|
|
|
|
|
| Unsigned integer |
|
|
|
|
|
|
|
|
|
|
|
|
| Unsigned integer |
|
|
|
|
|
|
| N/E | N/E |
|
|
|
|
|
|
|
|
|
|
|
| N/E | N/E |
|
|
|
|
|
|
|
|
|
|
|
| N/E | N/E |
|
|
|
|
|
|
|
|
|
|
|
| N/E | N/E |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| NTWS |
|
|
|
|
| NTBS or NTWS |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Pointer to integer |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| NTWS |
|
|
|
|
|
|
|
|
|
|
|
|
| None |
...
Do not supply an unknown or invalid conversion specification or an invalid combination of flag character, precision, length modifier, or conversion specifier to a formatted IO function. Likewise, do not provide a number or type of arguments argument that do does not match the argument type of the conversion specifier used in the format string.
Format strings are usually string literals specified at the call site, but they need not be. However, they should not contain tainted values. (see See FIO30-C. Exclude user input from format strings for more information.).
Noncompliant Code Example
...