Page History

The formatted output functions (fprintf() and related functions) convert, format, and print their arguments under control of a format string. The C Standard, 7.2123.6.1, paragraph 3 [ISO/IEC 9899:20112024], specifies

The format shall be a multibyte character sequence, beginning and ending in its initial shift state. The format is composed of zero or more directives: ordinary multibyte characters (not %), which are copied unchanged to the output stream; and conversion specifications, each of which results in fetching zero or more subsequent arguments, converting them, if applicable, according to the corresponding conversion specifier, and then writing the result to the output stream.

...

• Zero or more flags (in any order), which modify the meaning of the conversion specification
• An optional minimum field width
• An optional precision that gives the minimum number of digits, the maximum number of digits to appear for certain conversion specifiers, or the maximum number of bytes, etc. depending on the conversion specifier
• An optional length modifier that specifies the size of the argument
• A conversion specifier character that indicates the type of conversion to be applied

...

Valid and meaningful combinations are marked by the  symbol (save for the length modifier columns, as described previously). Valid combinations that have no effect are labeled N/E. Using a combination marked by the symbol, using a specification not represented in the table, or using an argument of an unexpected type is undefined behavior. (See undefined behaviors 153 158, 155 160, 157 162, 158 163, 161 166, and 162 167.) 

Conversion Specifier Character	' XSI	- + SPACE	#	0	h	hh	l	ll	j	z	t	L	Argument Type
d, i					short	signed char	long	long long	intmax_t	size_t	ptrdiff_t		Signed integer
o					unsigned short	unsigned char	unsigned long	unsigned long long	uintmax_t	size_t	ptrdiff_t		Unsigned integer
u					unsigned short	unsigned  char	unsigned long	unsigned long long	uintmax_t	size_t	ptrdiff_t		Unsigned integer
x, X					unsigned short	unsigned char	unsigned long	unsigned long long	uintmax_t	size_t	ptrdiff_t		Unsigned integer
f, F							N/E	N/E				long double	double or long double
e, E							N/E	N/E				long double	double or long double
g, G							N/E	N/E				long double	double or long double
a, A							N/E	N/E				long double	double or long double
c							wint_t						int or wint_t
s							NTWS						NTBS or NTWS
p													void*
n

short*

char*

long*

long long*

intmax_t*

size_t*

ptrdiff_t*

Pointer to integer

C XSI

wint_t

S XSI

NTWS

%

None

     SPACE: The space (" ") character
     N/E: No effect
     NTBS: char* argument pointing to a null-terminated character string
     NTWS: wchar_t* argument pointing to a null-terminated wide character string
     XSI: ISO/IEC 9945-2003 XSI extension

...

Incorrectly specified format strings can result in memory corruption or abnormal program termination.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-686 and FIO47-C

Intersection( EXP37-C, FIO47-C) =

• Invalid argument types passed to format I/O function

EXP37-C – FIO47-C =

• Invalid argument types passed to non-format I/O function

FIO47-C – EXP37-C =

• Invalid format string, but correctly matches arguments in number and type

Intersection( CWE-686, FIO47-C) =

• Use of format strings that do not match the type of arguments

CWE-686 – FIO47-C =

• Incorrect argument type in functions outside of the printf() family.

FIO47-C – CWE-686 =

• Invalid format strings that still match their arguments in type

CWE-685 and FIO47-C

Intersection( CWE-685, FIO47-C) =

• Use of format strings that do not match the number of arguments

CWE-685 – FIO47-C =

• Incorrect argument number in functions outside of the printf() family.

FIO47-C – CWE-685 =

• Invalid format strings that still match their arguments in number

CWE-134 and FIO47-C

Intersection( FIO30-C, FIO47-C) =

• Use of untrusted and ill-specified format string

FIO30-C – FIO47-C =

• Use of untrusted, but well-defined format string

FIO47-C – FIO30-C =

• Use of Ill-defined, but trusted format string

FIO47-C = Union(CWE-134, list) where list =

• Using a trusted but invalid format string

Bibliography

...

...

Image Modified Image Modified Image Modified