Page History

Variadic functions accept a variable number of arguments but are problematic. Variadic functions define an implicit contract between the function writer and the function user that allows the function to determine the number of arguments passed in any particular invocation. Failure to enforce this contract may result in undefined behavior. See undefined behavior 141 of Appendix J of the C Standard.

Argument Processing

...

In the following code example, the variadic function {{average()}} calculates the average value of the positive integer arguments passed to the function \ [[Seacord 05c|AA. C References#Seacord 05c]\Seacord 2013]. The function processes arguments until it encounters an argument with the value of {{va_eol}} ({{\-1}}).

Code Block
enum { va_eol = -1 }; unsigned int average(int first, ...) { unsigned int count = 0; unsigned int sum = 0; int i = first; va_list args; va_start(args, first); while (i != va_eol) { sum += i; count++; i = va_arg(args, int); } va_end(args); return(count ? (sum / count) : 0); }

...

In this noncompliant code example, the average() function is called as follows:

Code Block
bgColor #ffcccc lang c
int avg = average(1, 4, 6, 4, 1);

...

This compliant solution enforces the contract by adding va_eol as the final argument.:

Code Block
bgColor #ccccff lang c
int avg = average(1, 4, 6, 4, 1, va_eol);

...

Another common mistake is to use more conversion specifiers than supplied arguments, as shown in this noncompliant coding code example. :

Code Block
bgColor #ffcccc lang c
const char *error_msg = "Resource not available to user."; /* ... */ printf("Error (%s): %s", error_msg);

This results code results in non-existent nonexistent arguments being processed by the function, potentially leaking information about the process.

...

This compliant solution matches the number of format specifiers with the number of variable arguments.:

Code Block
bgColor #ccccff lang c
const char *error_msg = "Resource not available to user."; /* ... */ printf("Error: %s", error_msg);

Argument List Caveats

C99 C functions that accept the variadic primitive va_list as an argument pose an additional risk. Calls to vfprintf(), vfscanf(), vprintf(), vscanf(), vsnprintf(), vsprintf(), and vsscanf() use the va_arg() macro, invalidating the parameterized va_list. Consequently, once a va_list is passed as an argument to any of these functions, it cannot be used again without a call to va_end() followed by a call to va_start().

...

Incorrectly using a variadic function can result in abnormal program termination or unintended information disclosure.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Automated Detection

...

Related Guidelines

Bibliography

...

Image Added Image Added Image Added

Other Languages

This rule appears in the C++ Secure Coding Standard as DCL10-CPP. Maintain the contract between the writer and caller of variadic functions.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.15, "Variable arguments," and Section 7.19.6.8, "The {{vfprintf}} function"
\[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "OTR Subprogram Signature Mismatch"
\[[MISRA 04|AA. C References#MISRA 04]\] Rule 16.1
\[[Seacord 05c|AA. C References#Seacord 05c]\]

DCL09-C. Declare functions that return an errno error code with a return type of errno_t      02. Declarations and Initialization (DCL)       DCL11-C. Ensure type consistency when using variadic functions