STR08-A. Take care when creating format strings

Several common mistakes in creating format strings are listed below:

• using invalid conversion specifiers
• using a length modifier on an incorrect specifier
• argument and conversion specifier type mismatch
• using invalid character classes

The following are C99 compliant conversion specifiers. Using any other specifier may result in undefined behavior.

d, i, o, u, x, X, f, F, e, E, g, G, a, A, c, s, p, n, %

Only some of the conversion specifiers are able to correctly take a length modifier. Using a length modifier on any specifier others than the following may result in undefined behavior.

d, i, o, u, x, X, a, A, e, E, f, F, g, G

Also, character class ranges must be properly specified, with a hyphen in between two printable characters. The two following lines are both properly specified. The first accepts any character from a-z, inclusive, while the second accepts anything that is not a-z, inclusive.

[a-z]
[^a-z]

Having an argument and conversion specifier mismatch may result in undefined behavior.

char *error_msg = "Resource not available to user.";
int error_type = 3;
/* ... */
printf("Error (type %s): %d\n", error_type, error_msg);

Risk Assessment

In most cases, the undefined behavior referred to above will result in abnormal program termination.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[ISO/IEC 9899-1999:TC2]] Section 7.19.6.1, "The fprintf function"