The formatted output functions (fprintf()
and related functions) convert, format, and print their arguments under control of a format string. The C Standard, 7.23.6.1, paragraph 3 [ISO/IEC 9899:2024], specifies
The format shall be a multibyte character sequence
Wiki Markup |
---|
The formatted IO functions {{fprintf()}}, {{printf()}}, {{sprintf()}}, {{snprintf()}}, {{vfprintf()}}, {{vprintf()}}, {{vsprintf()}}, and {{vsnprintf()}} convert, format, and print their arguments under control of a _format_ string. According to \[[ISO/IEC 9899:1999| AA. References#ISO/IEC 9899-1999 | Programming Languages---C]\]: |
The format is a character string, beginning and ending in its initial shift state, if any. The format is composed of zero or more directives: ordinary multibyte characters (not %), which are simply copied unchanged to the output stream, ; and conversion specifications, each of which shall result results in the fetching of zero or more subsequent arguments, converting them, if applicable, according to the corresponding conversion specifier, and then writing the result to the output stream.
Each conversion specification is introduced by the '%'
character followed by the following (in order): by
- Zero or more flags (in any order), which modify the meaning of the conversion specification.
- An optional minimum field width.
- An optional precision that gives the minimum number of digits, the maximum number of digits to appear for certain conversion specifiers., or the maximum number of bytes, etc. depending on the conversion specifier
- An optional length modifier that specifies the size of the argument.
- A conversion specifier character that indicates the type of conversion to be applied.
Common mistakes in creating format strings include:
- Providing an incorrect number of providing insufficient arguments for the format string
- using Using invalid conversion specifiers
- using Using a flag character that is incompatible with the conversion specifier
- using Using a length modifier that is incompatible with the conversion specifier
- mismatching Mismatching the argument type and conversion specifier
- using Using an argument of type other than
int
for width or precision
The following table summarizes C99-compliant conversion specifiers along with the flag characters (the apostrophe ('
)the compliance of various conversion specifications. The first column contains one or more conversion specifier characters. The next four columns consider the combination of the specifier characters with the various flags (the apostrophe ['
], -
, +
, the space character, and #
in columns 2, through 5) and , and 0
). The next eight columns consider the combination of the specifier characters with the various length modifiers (h
, hh
, l
, ll
, j
, z
, t
, and L
in columns 6 through 13).
Valid combinations are marked with a type name; arguments matched with the conversion specification are interpreted as that type. For example, an argument matched with the specifier %hd
is interpreted as a short
, so short
appears in the cell where d
and h
intersect. The last column denotes the expected types of arguments matched with the original specifier characters.
Valid and meaningful combinations are marked by the symbol (save for the length modifier columns, as described previously) valid for each specification, and the type of the expected argument. Valid and meaningful combinations of a conversion specification, flag character, and length modifier is denoted by the symbol in the corresponding cell or by the name of the type argument effected by the length modifier. Valid combinations that have no effect are denoted by labeled N/E. Using a combination of a conversion specification, flag character, and length modifier denoted marked by the symbol or a , using a specification not listed represented in the table, or using an argument of argument of an unexpected type may result in is undefined behavior. (See undefined behavior 145, 149, 150, 153, and 154 in Annex J of C99.behaviors 153, 155, 157, 158, 161, and 162.)
Conversion |
|
|
|
|
---|
|
|
|
|
|
|
|
| Argument |
---|---|---|---|---|---|---|---|---|
|
|
|
|
|
|
|
|
Signed integer | ||||
|
|
|
|
|
|
|
|
Unsigned integer | ||||
|
|
char
long
long long
intmax_t
size_t
ptrdiff_t
|
x
|
short
|
|
|
|
|
|
Unsigned integer | ||||
|
|
|
|
|
|
|
|
Unsigned integer | ||||
|
N/E | N/E |
|
| |||||
|
N/E | N/E |
|
| |||||
|
N/E | N/E |
|
| ||||||
|
N/E | N/E |
|
| ||||||
|
|
| |||||||
|
NTWS | NTBS or NTWS | |||||||
|
| ||||||||
|
|
|
|
|
|
|
|
Pointer to integer | ||||
|
| |||||||||
|
NTWS | ||||||||
|
None |
Legend:
...
SPACE: The space (
...
" "
) character
N/E
...
: No
...
effect
NTBS
...
: char*
argument pointing to a
...
null-terminated character string
NTWS: wchar_t*
argument pointing to a
...
null-
...
terminated wide character
...
string
XSI
...
: ISO/IEC 9945-2003 XSI extension
The formatted input functions (fscanf()
and related functions) use similarly specified format strings and impose similar restrictions on their format strings and arguments.
Do not supply an unknown or invalid conversion specification or an invalid combination of flag character, precision, length modifier, or conversion specifier to a formatted IO function. Likewise, do not provide a number or type of argument that does not match the argument type of the conversion specifier used in the format string.
Format strings are usually string literals specified at the call site, but they need not be. However, they should not contain tainted values. (See FIO30-C. Exclude user input from format strings for more information.)
Noncompliant Code Example
Mismatches between arguments and conversion specifications may result in undefined behavior. Many compilers can Compilers may diagnose type mismatches in formatted output function invocations. In this noncompliant code example, the error_type
argument to printf()
is incorrectly matched with the s
specifier rather than with the d
specifier. Likewise, the error_msg
argument is incorrectly matched with the d
specifier instead of the s
specifier. These usages result in undefined behavior. One possible result of this invocation is that printf()
will interpret the error_type
argument as a pointer and try to read a string from the address that error_type
contains, possibly resulting in an access violation.
Code Block | ||||
---|---|---|---|---|
| ||||
#include <stdio.h> void func(void) { const char *error_msg = "Resource not available to user."; int error_type = 3; /* ... */ printf("Error (type %s): %d\n", error_type, error_msg); /* ... */ } |
Compliant Solution
This compliant solution ensures that the format arguments to the printf()
function match their respective format conversion specifications.:
Code Block | ||||
---|---|---|---|---|
| ||||
#include <stdio.h> void func(void) { const char *error_msg = "Resource not available to user."; int error_type = 3; /* ... */ printf("Error (type %d): %s\n", error_type, error_msg); |
Noncompliant Code Example
The width and precision arguments to printf()
format directives must be of type int
. According to C99:
A field width, or precision, or both, may be indicated by an asterisk ('*'). In this case an argument of type
int
supplies the field width or precision.
Passing them as any other type leads to undefined behavior. In this noncompliant code example, the width and precision are specified using parameters declared to be of size_t
type. These are unsigned types that may not be the same size as int
.
Code Block | ||
---|---|---|
| ||
int print_int(int i, size_t width, size_t prec) { int n; n = printf("%*.*d", width, prec, i); return n; } |
Compliant Solution
In this compliant solution, the field width and precision arguments to printf()
format directives are of type int
.
Code Block | ||
---|---|---|
| ||
int print_int(int i, int width, int prec) {
int n;
n = printf("%*.*d", width, prec, i);
return n;
}
|
Risk Assessment
/* ... */
} |
Risk Assessment
Incorrectly specified format strings can result in memory corruption or In most cases, incorrectly specified format strings will result in abnormal program termination.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|
FIO47-C |
High |
Unlikely |
Medium | P6 | L2 |
Automated Detection
...
The LDRA tool suite V 7.6.0 can detect violations of this recommendation.
...
Tool | Version | Checker | Description | ||||||
---|---|---|---|---|---|---|---|---|---|
Axivion Bauhaus Suite |
| CertC-FIO47 | Fully implemented | ||||||
CodeSonar |
| IO.INJ.FMT | Format string injection | ||||||
Coverity |
| PW | Reports when the number of arguments differs from the number of required arguments according to the format string | ||||||
GCC |
| Can detect violations of this recommendation when the | |||||||
Helix QAC |
| C0161, C0162, C0163, C0164, C0165, C0166, C0167, C0168, C0169, C0170, C0171, C0172, C0173, C0174, C0175, C0176, C0177, C0178, C0179, C0180, C0184, C0185, C0190, C0191, C0192, C0193, C0194, C0195, C0196, C0197, C0198, C0199, C0200, C0201, C0202, C0204, C0206, C0209 C++3150, C++3151, C++3152, C++3153, C++3154, C++3155, C++3156, C++3157, C++3158, C++3159 | |||||||
Klocwork |
| SV.FMT_STR.PRINT_FORMAT_MISMATCH.BAD | |||||||
LDRA tool suite |
| 486 S | Fully implemented | ||||||
Parasoft C/C++test |
| CERT_C-FIO47-a | There should be no mismatch between the '%s' and '%c' format specifiers in the format string and their corresponding arguments in the invocation of a string formatting function | ||||||
PC-lint Plus |
| 492, 493, 494, 499, 557, | Fully supported | ||||||
Polyspace Bug Finder |
| CERT C: Rule FIO47-C | Check for format string specifiers and arguments mismatch (rule fully covered) | ||||||
PVS-Studio |
| V510, V576 | |||||||
TrustInSoft Analyzer |
| match format and arguments | Exhaustively verified (see the compliant and the non-compliant example). |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Other Languages
...
Related Guidelines
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
---|---|---|
CERT C | FIO00-CPP. Take care when creating format strings | Prior to 2018-01-12: CERT: Unspecified Relationship |
ISO/IEC TS 17961:2013 | Using invalid format strings [invfmtstr] | Prior to 2018-01-12: CERT: Unspecified Relationship |
CWE 2.11 | CWE-686, Function Call with Incorrect Argument Type | 2017-06-29: CERT: Partial overlap |
CWE 2.11 | CWE-685 | 2017-06-29: CERT: Partial overlap |
CERT-CWE Mapping Notes
Key here for mapping notes
CWE-686 and FIO47-C
Intersection( EXP37-C, FIO47-C) =
- Invalid argument types passed to format I/O function
EXP37-C – FIO47-C =
- Invalid argument types passed to non-format I/O function
FIO47-C – EXP37-C =
- Invalid format string, but correctly matches arguments in number and type
Intersection( CWE-686, FIO47-C) =
- Use of format strings that do not match the type of arguments
CWE-686 – FIO47-C =
- Incorrect argument type in functions outside of the printf() family.
...
FIO47-C – CWE-686 =
- Invalid format strings that still match their arguments in type
CWE-685 and FIO47-C
Intersection( CWE-685, FIO47-C) =
- Use of format strings that do not match the number of arguments
CWE-685 – FIO47-C =
- Incorrect argument number in functions outside of the printf() family.
FIO47-C – CWE-685 =
- Invalid format strings that still match their arguments in number
CWE-134 and FIO47-C
Intersection( FIO30-C, FIO47-C) =
- Use of untrusted and ill-specified format string
FIO30-C – FIO47-C =
- Use of untrusted, but well-defined format string
FIO47-C – FIO30-C =
- Use of Ill-defined, but trusted format string
FIO47-C = Union(CWE-134, list) where list =
- Using a trusted but invalid format string
Bibliography
[ISO/IEC 9899:2024] | Subclause 7.23.6.1, "The fprintf Function" |
...
References
Wiki Markup |
---|
\[[ISO/IEC 9899:1999|AA. References#ISO/IEC 9899-1999]\] Section 7.19.6.1, "The {{fprintf}} function"
\[[MITRE 07|AA. References#MITRE 07]\] [CWE ID 686|http://cwe.mitre.org/data/definitions/686.html], "Function Call With Incorrect Argument Type" |