Page History

...

Character class ranges must also be properly specified with a hyphen in between two printable characters. The two following lines are both properly specified. The first accepts any character from a-z, inclusive, while the second accepts anything that is not a-z, inclusive.

[a-z]
[^aFIO00-C. Take care when creating format strings^a-z]

Note that the range is in terms of character code values, and on an EBCDIC platform it will include some non-alphabetic codes. Consequently the isalpha() function should be used to verify the input.

...

Noncompliant Code Example

Mismatches between arguments and conversion specifiers may result in undefined behavior. Many compilers can diagnose type mismatches in formatted output function invocations.

const char const *error_msg = "Resource not available to user.";
int error_type = 3;
/* ... */
printf("Error (type %s): %d\n", error_type, error_msg);

Compliant Solution

This compliant solution ensures that the format arguments match their respective format specifiers.

const char const *error_msg = "Resource not available to user.";
int error_type = 3;
/* ... */
printf("Error (type %d): %s\n", error_type, error_msg);

Risk Assessment

In most cases, incorrectly specified format strings will result in abnormal program termination.

Automated Detection

The LDRA tool suite V 7.6.0 is able to can detect violations of this recommendation.

GNU C allows the -Wformat compiler option that does substantial checking of formats and arguments.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.19.6.1, "The {{fprintf}} function"

...

09. Input Output (FIO)      09. Input Output (FIO)       FIO01-A. Be careful using functions that use file names for identification Image Added