Page History

The formatted output functions (fprintf() and related functions) convert, format, and print their arguments under control of a format string. The C Standard, 7.23.6.1, paragraph 3 [ISO/IEC 9899:2024], specifies

The format shall be a multibyte character sequence, beginning and ending in its initial shift state. The format is composed of zero or more directives: ordinary multibyte characters (not %), which are copied unchanged to the output stream; and conversion specifications, each of which results in fetching zero or more subsequent arguments, converting them, if applicable, according to the corresponding conversion specifier, and then writing the result to the output stream.

Each conversion specification is introduced by the % character followed (in order) by

• Zero or more flags (in any order), which modify the meaning of the conversion specification
• An optional minimum field width
• An optional precision that gives the minimum number of digits, the maximum number of digits, or the maximum number of bytes, etc. depending on the conversion specifier
• An optional length modifier that specifies the size of the argument
• A conversion specifier character that indicates the type of conversion to be applied

Common mistakes in creating format strings include

• Providing an incorrect number of arguments for the format string
• Using invalid conversion specifiers
• Using a flag character that is incompatible with the conversion specifier
• Using a length modifier on an incorrect that is incompatible with the conversion specifier
• Mismatching the argument type and conversion specifier type
• Using invalid character classes

The following are C99 compliant conversion specifiers \[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\]. Using any other specifier may result in [undefined behavior|BB. Definitions#undefined behavior].

d, i, o, u, x, X, f, F, e, E, g, G, a, A, c, s, p, n, %

Only some of the conversion specifiers are able to correctly take a length modifier. Using a length modifier on any specifier other than the following may result in undefined behavior.

d, i, o, u, x, X, a, A, e, E, f, F, g, G

Character class ranges must also be properly specified with a hyphen in between two printable characters. The two following lines are both properly specified. The first accepts any character from a-z, inclusive, while the second accepts anything that is not a-z, inclusive.

[a-z]
[FIO00-C. Take care when creating format strings^a-z]

• Using an argument of type other than int for width or precision

The following table summarizes the compliance of various conversion specifications. The first column contains one or more conversion specifier characters. The next four columns consider the combination of the specifier characters with the various flags (the apostrophe ['], -, +, the space character, #, and 0). The next eight columns consider the combination of the specifier characters with the various length modifiers (h, hh, l, ll, j, z, t, and L).

Valid combinations are marked with a type name; arguments matched with the conversion specification are interpreted as that type. For example, an argument matched with the specifier %hd is interpreted as a short, so short appears in the cell where d and h intersect. The last column denotes the expected types of arguments matched with the original specifier characters.

Valid and meaningful combinations are marked by the  symbol (save for the length modifier columns, as described previously). Valid combinations that have no effect are labeled N/E. Using a combination marked by the symbol, using a specification not represented in the table, or using an argument of an unexpected type is undefined behavior. (See undefined behaviors 153, 155, 157, 158, 161, and 162.) 

     SPACE: The space (" ") character
     N/E: No effect
     NTBS: char* argument pointing to a null-terminated character string
     NTWS: wchar_t* argument pointing to a null-terminated wide character string
     XSI: ISO/IEC 9945-2003 XSI extension

The formatted input functions (fscanf() and related functions) use similarly specified format strings and impose similar restrictions on their format strings and arguments.

Do not supply an unknown or invalid conversion specification or an invalid combination of flag character, precision, length modifier, or conversion specifier to a formatted IO function. Likewise, do not provide a number or type of argument that does not match the argument type of the conversion specifier used in the format string.

Format strings are usually string literals specified at the call site, but they need not be. However, they should not contain tainted values. (See FIO30-C. Exclude user input from format strings for more information.)Note that the range is in terms of character code values, and on an EBCDIC platform it will include some non-alphabetic codes. Consequently the isalpha() function should be used to verify the input.

Noncompliant Code Example

Mismatches between arguments and conversion specifiers specifications may result in undefined behavior. Many compilers can Compilers may diagnose type mismatches in formatted output function invocations. In this noncompliant code example, the error_type argument to printf() is incorrectly matched with the s specifier rather than with the d specifier. Likewise, the error_msg argument is incorrectly matched with the d specifier instead of the s specifier. These usages result in undefined behavior. One possible result of this invocation is that printf() will interpret the error_type argument as a pointer and try to read a string from the address that error_type contains, possibly resulting in an access violation.

#include <stdio.h>
 
void func(void) {
  const char *error_msg = "Resource not available to user.";
  int error_type = 3;
  /* ... */
  printf("Error (type %s): %d\n", error_type, error_msg);
  /* ... */
}

Compliant Solution

This compliant solution ensures that the format arguments to the printf() function match their respective format specifiers.conversion specifications:

#include <stdio.h>
 
void func(void) {
  const char *error_msg = "Resource not available to user.";
  int error_type = 3;
  /* ... */
  printf("Error (type %d): %s\n", error_type, error_msg);

  /* ... */
}

Risk Assessment

In most cases, incorrectly Incorrectly specified format strings will can result in memory corruption or abnormal program termination.

Automated Detection

...

The LDRA tool suite V 7.6.0 can detect violations of this recommendation.

...

Tool	Version	Checker	Description
Axivion Bauhaus Suite	Include Page Axivion Bauhaus Suite_V Axivion Bauhaus Suite_V	CertC-FIO47	Fully implemented
CodeSonar	Include Page CodeSonar_V CodeSonar_V	IO.INJ.FMT MISC.FMT MISC.FMTTYPE	Format string injection Format string Format string type error
Coverity	Include Page Coverity_V Coverity_V	PW	Reports when the number of arguments differs from the number of required arguments according to the format string
GCC	Include Page GCC_V GCC_V		Can detect violations of this recommendation when the -Wformat flag is used
Helix QAC	Include Page Helix QAC_V Helix QAC_V	C0161, C0162, C0163, C0164, C0165, C0166, C0167, C0168, C0169, C0170, C0171, C0172, C0173, C0174, C0175, C0176, C0177, C0178, C0179, C0180, C0184, C0185, C0190, C0191, C0192, C0193, C0194, C0195, C0196, C0197, C0198, C0199, C0200, C0201, C0202, C0204, C0206, C0209 C++3150, C++3151, C++3152, C++3153, C++3154, C++3155, C++3156, C++3157, C++3158, C++3159
Klocwork	Include Page Klocwork_V Klocwork_V	SV.FMT_STR.PRINT_FORMAT_MISMATCH.BAD SV.FMT_STR.PRINT_FORMAT_MISMATCH.UNDESIRED SV.FMT_STR.PRINT_IMPROP_LENGTH SV.FMT_STR.PRINT_PARAMS_WRONGNUM.FEW SV.FMT_STR.PRINT_PARAMS_WRONGNUM.MANY SV.FMT_STR.SCAN_FORMAT_MISMATCH.BAD SV.FMT_STR.SCAN_FORMAT_MISMATCH.UNDESIRED SV.FMT_STR.SCAN_IMPROP_LENGTH SV.FMT_STR.SCAN_PARAMS_WRONGNUM.FEW SV.FMT_STR.SCAN_PARAMS_WRONGNUM.MANY SV.FMT_STR.UNKWN_FORMAT
LDRA tool suite	Include Page LDRA_V LDRA_V	486 S 589 S	Fully implemented
Parasoft C/C++test	Include Page Parasoft_V Parasoft_V	CERT_C-FIO47-a CERT_C-FIO47-b CERT_C-FIO47-c CERT_C-FIO47-d CERT_C-FIO47-e CERT_C-FIO47-f	There should be no mismatch between the '%s' and '%c' format specifiers in the format string and their corresponding arguments in the invocation of a string formatting function There should be no mismatch between the '%f' format specifier in the format string and its corresponding argument in the invocation of a string formatting function There should be no mismatch between the '%i' and '%d' format specifiers in the string and their corresponding arguments in the invocation of a string formatting function There should be no mismatch between the '%u' format specifier in the format string and its corresponding argument in the invocation of a string formatting function There should be no mismatch between the '%p' format specifier in the format string and its corresponding argument in the invocation of a string formatting function The number of format specifiers in the format string and the number of corresponding arguments in the invocation of a string formatting function should be equal
PC-lint Plus	Include Page PC-lint Plus_V PC-lint Plus_V	492, 493, 494, 499, 557, 558, 559, 566, 705, 706, 719, 816, 855, 2401, 2402, 2403, 2404, 2405, 2406, 2407	Fully supported
Polyspace Bug Finder	Include Page Polyspace Bug Finder_V Polyspace Bug Finder_V	CERT C: Rule FIO47-C	Check for format string specifiers and arguments mismatch (rule fully covered)
PVS-Studio	Include Page PVS-Studio_V PVS-Studio_V	V510, V576
TrustInSoft Analyzer	Include Page TrustInSoft Analyzer_V TrustInSoft Analyzer_V	match format and arguments	Exhaustively verified (see the compliant and the non-compliant example).

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.19.6.1, "The {{fprintf}} function"

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-686 and FIO47-C

Intersection( EXP37-C, FIO47-C) =

• Invalid argument types passed to format I/O function

EXP37-C – FIO47-C =

• Invalid argument types passed to non-format I/O function

FIO47-C – EXP37-C =

• Invalid format string, but correctly matches arguments in number and type

Intersection( CWE-686, FIO47-C) =

• Use of format strings that do not match the type of arguments

CWE-686 – FIO47-C =

• Incorrect argument type in functions outside of the printf() family.

FIO47-C – CWE-686 =

• Invalid format strings that still match their arguments in type

CWE-685 and FIO47-C

Intersection( CWE-685, FIO47-C) =

• Use of format strings that do not match the number of arguments

CWE-685 – FIO47-C =

• Incorrect argument number in functions outside of the printf() family.

FIO47-C – CWE-685 =

• Invalid format strings that still match their arguments in number

CWE-134 and FIO47-C

Intersection( FIO30-C, FIO47-C) =

• Use of untrusted and ill-specified format string

FIO30-C – FIO47-C =

• Use of untrusted, but well-defined format string

FIO47-C – FIO30-C =

• Use of Ill-defined, but trusted format string

FIO47-C = Union(CWE-134, list) where list =

• Using a trusted but invalid format string

Bibliography

...

Image Added Image Added 09. Input Output (FIO)      09. Input Output (FIO)       Image Modified