Page History

The formatted output functions (fprintf() and related functions) convert, format, and print their arguments under control of a format string, defined as follows by the C Standard, 7.21.6.1, paragraph 3 [ISO/IEC 9899:2011]:

...

Common mistakes in creating format strings include

• Providing insufficient an incorrect number of arguments for the format string
• Using invalid conversion specifiers
• Using a flag character that is incompatible with the conversion specifier
• Using a length modifier that is incompatible with the conversion specifier
• Mismatching the argument type and conversion specifier
• Using an argument of type other than int for width or precision

The following table summarizes the compliance of various conversion specifications.   The first column contains a conversion specifier character (or characters).   The next four columns consider the combination of the specifier character(s) with the various flags (the apostrophe ['], -, +, the space character, #, and # 0).   The next eight columns consider the combination of the specifier character(s) with the various length modifiers (h, hh, l, ll, j, z, t, and L).   Here, valid Valid combinations are marked with a type name; arguments matched with the conversion specification will be interpreted as that type.   For example, an argument matched with the specifier %hd will be interpreted as a short, so short appears in the cell where d and h intersect.   The last column denotes the expected type of arguments matched with the original specifier character(s).   Throughout the table, valid Valid and meaningful combinations are marked by the  symbol (save for the length modifier columns, as described above).   Valid combinations that have no effect are labeled N/E.   Using a combination marked by the symbol, using a specification not represented in the table, or using an argument of an unexpected type may result in undefined behavior. See undefined behaviors 153, 155, 157, 158, 161, and 162 in Annex J of the C Standard. 

Legend:

• SPACE—the space (" ") character
• N/E—no effect
• NTBS—char* argument pointing to a null-terminated byte string
• NTWS—wchar_t* argument pointing to a null-terminated wide character string
• XSI—ISO/IEC 9945-2003 XSI extension

The format formatted input functions (fscanf() and related functions) use similarly-specified format strings and impose similar restrictions on their format strings and arguments.

Do not supply an unknown or invalid conversion specification or an invalid combination of flag character, precision, length modifier, conversion specifier; to a formatted IO function. Likewise, do not provide a number or type of arguments that do not match the conversion specifiers argument type of the conversion specifier used in the format string.

Format strings are usually string literals specified at the call site, but they need not be. They should, however, not contain unsanitized data; see FIO30-C. Exclude user input from format strings for more information.

...

Mismatches between arguments and conversion specifications may result in undefined behavior.   Many compilers can Compilers may diagnose type mismatches in formatted output function invocations.   In the following noncompliant code example, the error_type argument to printf() is incorrectly matched with the %s specifier, rather than with the the %d specifier specifier. Likewise, the the error_msg argument is incorrectly matched with the %d specifier instead of the %s specifier.   These usages result in undefined behavior. One possible result of this invocation is that printf() will interpret the error_type argument as a pointer, and try to read a string from the address that error_type contains. This is likely to result , possibly resulting in an access violation.

#include <stdio.h>
 
void func(void) {
  const char *error_msg = "Resource not available to user.";
  int error_type = 3;
  /* ... */
  printf("Error (type %s): %d\n", error_type, error_msg);
  /* ... */
}

...

#include <stdio.h>
 
void func(void) {
  const char *error_msg = "Resource not available to user.";
  int error_type = 3;
  /* ... */
  printf("Error (type %d): %s\n", error_type, error_msg);

  /* ... */
}

Risk Assessment

In most cases, incorrectly Incorrectly specified format strings will can result in abnormal program termination. However, in some cases they can be used to corrupt memory in manners a manner controllable by an attacker.

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

...