DCL11-A. Understand the type issues associated with variadic functions

The macros associated with the use of variadic functions implicitly use the parameterized type to determine how many bytes should be pulled for the argument. If the the type is inconsistent with how it is used, misinterpreted data or an alignment error (see EXP36-C. Do not cast between pointers between objects or types with differing alignments) could result.

For example, some C99 functions, such as printf(), are implemented as a variadic functions, if care is not taken to ensure that the conversion specifiers to these do not match up with the type of the intended parameter, the result may be abnormal program termination or misinterpreted data.

Non-Compliant Code Example 1

The following non-compliant code swaps its null terminated byte string and integer parameters with respect to how they were specified in the format string. This means that the integer will be silently casted into a pointer to a null terminated byte string and then dereferenced, possibly causing the program to abnormally terminate (error_message pointer will likewise be silently converted into an integer).

char const *error_msg = "Error occurred";
/* ... */
printf("%s:%d", 15, error_msg);

Compliant Solution 1

This compliant solution is formatted so that the specifiers are consistent with their parameters.

char const *error_msg = "Error occurred";
/* ... */
printf("%d:%s", 15, error_msg);

As shown, care should be taken that the arguments passed to a format string function match up with the supplied format string.

Non-Compliant Code Example 2

In the following non-compliant code, a type long long integer is parsed by the printf() function with just a %d specifier, resulting in data truncation or misrepresentation when the value is pulled from the argument list.

long long a = 1;
char msg[128] = "Default message";

/* ... */

printf("%d %s", a, msg);

Because a long long was not interpreted, if the architecture is set up in a way that long long uses more bits for storage, the subsequent format specifier %s will be unexpectedly offset, causing unknown data to be used instead of the pointer to the message.

Compliant Solution 2

long long a = 1;
char msg[128] = "Default message";

/* ... */

printf("%lld %s", a, msg);

Risk Assessment

Inconsistent typing in variadic functions can result in abnormal program termination or unintended information disclosure.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[ISO/IEC 9899-1999:TC2]] Section 7.15, "Variable arguments"