Page History

The formatted IO formatted output functions fprintf(), printf(), sprintf(), snprintf(), vfprintf(), vprintf(), vsprintf(), and vsnprintf((fprintf() and related functions) convert, format, and print their arguments under control of a format string. Subclause , defined as follows by the C Standard, subclause 7.21.6.1 of the C Standard , paragraph 3 [ISO/IEC 9899:2011] states:

The format shall be a multibyte character sequence, beginning and ending in its initial shift state. The format is composed of zero or more directives: ordinary multibyte characters (not %), which are copied unchanged to the output stream; and conversion specifications, each of which results in fetching zero or more subsequent arguments, converting them, if applicable, according to the corresponding conversion specifier, and then writing the result to the output stream.

...

The following table summarizes C-compliant conversion specifiers along with the flag characters valid for each specification the compliance of various conversion specifications.  The first column contains a conversion specifier character (or characters).  The next four columns consider the combination of the specifier character(s) with the various flags (the apostrophe ['], -, +, the space character, and # in columns 2 through 5) and ).  The next eight columns consider the combination of the specifier character(s) with the various length modifiers (h, hh, l, ll, j, z, t, and L in columns 6 through 13) and the type of the expected argument. Valid and meaningful combinations of a conversion specification, flag character, and length modifier are denoted by the symbol in the corresponding cell or by the name of the type argument affected by the length modifier. .  Here, valid combinations are marked with a type name; arguments matched with the conversion specification will be interpreted as that type.  For example, an argument matched with the specifier %hd will be interpreted as a short, so short appears in the cell where d and h intersect.  The last column denotes the expected type of arguments matched with the original specifier character(s).  Throughout the table, valid and meaningful combinations are marked by the  symbol (save for the length modifier columns, as described above).  Valid combinations that have no effect are denoted by labeled N/E.  Using a combination of a conversion specification, flag character, and length modifier denoted marked by the symbol or a , using a specification not listed represented in the table, or using an argument of argument of an unexpected type , may result in undefined behavior. See undefined behaviors 153, 155,   157, 158, 161, and 162 in Annex J of the C Standard. 

...

Mismatches between arguments and conversion specifications may result in undefined behavior.  Many compilers can diagnose type mismatches in formatted output function invocations.  In the following noncompliant code example, the error_type argument to printf() is incorrectly matched with the %s specifier (should be %d), and the error_msg argument is incorrectly matched with the %d specifier (should be %s).  One possible result of this invocation is that printf() will interpret the error_type argument as a pointer, and try to read a string from the address that error_type contains (likely this will result in an access violation):

const char *error_msg = "Resource not available to user.";
int error_type = 3;
/* ... */
printf("Error (type %s): %d\n", error_type, error_msg);

...