Page History

...

The C99 printf() function is implemented as a variadic function. This non-compliant code example swaps its nullNULL-terminated byte string and integer parameters with respect to how they were specified in the format string. Consequently, the integer is interpreted as a pointer to a nullNULL-terminated byte string and dereferenced. This will likely cause the program to abnormally terminate. Note that the error_message pointer is likewise interpreted as an integer.

char const char *error_msg = "Error occurred";
/* ... */
printf("%s:%d", 15, error_msg);

...

This compliant solution is formatted so that the specifiers are consistent with their parameters.

char const char *error_msg = "Error occurred";
/* ... */
printf("%d:%s", 15, error_msg);

...

long long a = 1;
char const char msg[] = "Default message";
/* ... */
printf("%d %s", a, msg);

...

long long a = 1;
char const char msg[] = "Default message";
/* ... */
printf("%lld %s", a, msg);

...

Related Vulnerabilities

...