Page History

Variadic functions accept a variable number of arguments but are problematic. Variadic functions define an implicit contract between the function writer and the function user that allows the function to determine the number of arguments passed in any particular invocation. Failure to enforce this contract may result in undefined behavior. See undefined behavior 141 141 of Appendix J of the C standardStandard.

Argument Processing

In the following code example, the variadic function average() calculates the average value of the positive integer arguments passed to the function [Seacord 2005c2013]. The function processes arguments until it encounters an argument with the value of va_eol (-1).

...

This compliant solution enforces the contract by adding va_eol as the final argument.:

Code Block

bgColor	#ccccff
lang	c

int avg = average(1, 4, 6, 4, 1, va_eol);

...

Another common mistake is to use more conversion specifiers than supplied arguments, as shown in this noncompliant code example.:

Code Block

bgColor	#ffcccc
lang	c

const char *error_msg = "Resource not available to user.";
/* ... */
printf("Error (%s): %s", error_msg);

...

This compliant solution matches the number of format specifiers with the number of variable arguments.:

Code Block

bgColor	#ccccff
lang	c

const char *error_msg = "Resource not available to user.";
/* ... */
printf("Error: %s", error_msg);

...

Incorrectly using a variadic function can result in abnormal program termination or unintended information disclosure.

Recommendation	Severity	Likelihood	Remediation Cost	Priority	Level
DCL10-C

high

High

probable

Probable

high

High

P6

L2

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Automated Detection

Tool

Version

Checker

Description

Astrée

Include Page

	Astrée_V
	Astrée_V

Supported, but no explicit checker

Helix QAC

Include Page

	Helix QAC_V
	Helix QAC_V

C0185, C0184

Klocwork

Include Page

	Klocwork_V
	Klocwork_V

SV.FMT_STR.PRINT_PARAMS_WRONGNUM.FEW
SV.FMT_STR.PRINT_PARAMS_WRONGNUM.MANY
SV.FMT_STR.SCAN_PARAMS_WRONGNUM.FEW
SV.FMT_STR.SCAN_PARAMS_WRONGNUM.MANY

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

41 S

Partially implemented

Related Guidelines

...

Enhanced Enforcement

Parasoft C/C++test

Include Page

	Parasoft_V
	Parasoft_V

CERT_C-DCL10-a

The number of format specifiers in the format string and the number of corresponding arguments in the invocation of a string formatting function should be equal

PC-lint Plus

Include Page