...
Because arguments to variadic functions are untyped, the programmer is responsible for ensuring that arguments to variadic functions they are of the same type as the corresponding parameter except for the following cases:
- one type is a signed integer type, the other type is the corresponding unsigned integer type, and the value is representable in both types;
- one type is pointer to
voidand the other is a pointer to a character type.
...
The C99 printf() function is implemented as a variadic function. This non-compliant code example swaps its NULL null-terminated byte string and integer parameters with respect to how they were specified in the format string. Consequently, the integer is interpreted as a pointer to a NULL terminated byte string and dereferenced. This will likely cause the program to abnormally terminate. Note that the error_message pointer is likewise interpreted as an integer.
...
| Code Block | ||
|---|---|---|
| ||
const char *error_msg = "Error occurred";
/* ... */
printf("%d:%s", 15, error_msg);
|
As shown, care should must be taken to ensure that the arguments passed to a format string function match up with the supplied format string.
...
In this non-compliant code example, a type long long integer is incorrectly parsed by the printf() function with just a %d specifier, possibly resulting . This code may result in data truncation or misrepresentation when the value is pulled extracted from the argument list.
| Code Block | ||
|---|---|---|
| ||
long long a = 1;
char msg[128] = "Default message";
/* ... */
printf("%d %s", a, msg);
|
Because a long long was not interpreted, if the architecture is set up in a way that long long uses more bits bytes for storage, the subsequent format specifier %s is unexpectedly offset, causing unknown data to be used instead of the pointer to the message.
...
This compliant solution adds in the length modifier ll to the %d format specifier so that the variadic function parser for printf() pulls extracts the right amount of space off of correct number of bytes from the variable argument list for the long long argument.
| Code Block | ||
|---|---|---|
| ||
long long a = 1;
char msg[128] = "Default message";
/* ... */
printf("%lld %s", a, msg);
|
...