DCL11-A. Understand the type issues associated with variadic functions

The parameters of a variadic function are interpreted by the va_arg() macro. The va_arg() macro is used to extract the next argument from an initialized argument list within the body of a variadic function implementation. The size of each parameter is determined by the specified type. If type is inconsistent with the corresponding argument, the behavior is undefined and may result in misinterpreted data or an alignment error [[EXP36-C. Do not cast between pointers between objects or types with differing alignments]].

Because arguments to variadic functions are untyped, the programmer is responsible for ensuring that arguments to variadic functions are of the same type as the corresponding parameter except for the following cases:

• one type is a signed integer type, the other type is the corresponding unsigned integer type, and the value is representable in both types;
• one type is pointer to void and the other is a pointer to a character type.

Non-Compliant Code Example (format string types)

The C99 printf() function is implemented as a variadic function. This non-compliant code example swaps its null terminated byte string and integer parameters with respect to how they were specified in the format string. Consequently, the integer is interpreted as a pointer to a null terminated byte string and dereferenced. This will likely cause the program to abnormally terminate . Note that the error_message pointer is likewise interpreted as an integer.

char const *error_msg = "Error occurred";
/* ... */
printf("%s:%d", 15, error_msg);

Compliant Solution (format string types)

This compliant solution is formatted so that the specifiers are consistent with their parameters.

char const *error_msg = "Error occurred";
/* ... */
printf("%d:%s", 15, error_msg);

As shown, care should be taken that the arguments passed to a format string function match up with the supplied format string.

Non-Compliant Code Example (type alignment)

In this non-compliant code example, a type long long integer is parsed by the printf() function with just a %d specifier, possibly resulting in data truncation or misrepresentation when the value is pulled from the argument list.

long long a = 1;
char msg[128] = "Default message";
/* ... */
printf("%d %s", a, msg);

Because a long long was not interpreted, if the architecture is set up in a way that long long uses more bits for storage, the subsequent format specifier %s is unexpectedly offset, causing unknown data to be used instead of the pointer to the message.

Compliant Solution (type alignment)

This compliant solution adds in the length modifier ll to the %d format specifier so that the variadic function parser for printf() pulls the right amount of space off of the variable argument list for the long long argument.

long long a = 1;
char msg[128] = "Default message";
/* ... */
printf("%lld %s", a, msg);

Risk Assessment

Inconsistent typing in variadic functions can result in abnormal program termination or unintended information disclosure.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[ISO/IEC 9899-1999:TC2]] Section 7.15, "Variable arguments"