CertC-DCL11

Understand the type issues associated with variadic functions

Required inputs: IR

The variable parameters of a variadic function-that is, those that correspond with the position of the ellipsis-are interpreted by the va_arg() macro. The va_arg() macro is used to extract the next argument from an initialized argument list within the body of a variadic function implementation. The size of each parameter is determined by the specified type. If the type is inconsistent with the corresponding argument, the behavior is undefined and may result in misinterpreted data or an alignment error (see EXP36-C. Do not cast pointers into more strictly aligned pointer types).

The variable arguments to a variadic function are not checked for type by the compiler. As a result, the programmer is responsible for ensuring that they are compatible with the corresponding parameter after the default argument promotions:

  • Integer arguments of types ranked lower than int are promoted to int if int can hold all the values of that type; otherwise, they are promoted to unsigned int (the integer promotions).
  • Arguments of type float are promoted to double.
Noncompliant Code Example (Type Interpretation Error)

The C printf() function is implemented as a variadic function. This noncompliant code example swaps its null-terminated byte string and integer parameters with respect to how they are specified in the format string. Consequently, the integer is interpreted as a pointer to a null-terminated byte string and dereferenced, which will likely cause the program to abnormally terminate. Note that the error_message pointer is likewise interpreted as an integer. 

const char *error_msg = "Error occurred";
/* ... */
printf("%s:%d", 15, error_msg);
Compliant Solution (Type Interpretation Error)

This compliant solution modifies the format string so that the conversion specifiers correspond to the arguments:

const char *error_msg = "Error occurred";
/* ... */
printf("%d:%s", 15, error_msg);

As shown, care must be taken to ensure that the arguments passed to a format string function match up with the supplied format string.

Noncompliant Code Example (Type Alignment Error)

In this noncompliant code example, a type long long integer is incorrectly parsed by the printf() function with a %d specifier. This code may result in data truncation or misrepresentation when the value is extracted from the argument list. 

long long a = 1;
const char msg[] = "Default message";
/* ... */
printf("%d %s", a, msg);

Because a long long was not interpreted, if the long long uses more bytes for storage, the subsequent format specifier %s is unexpectedly offset, causing unknown data to be used instead of the pointer to the message.

Compliant Solution (Type Alignment Error)

This compliant solution adds the length modifier ll to the %d format specifier so that the variadic function parser for printf() extracts the correct number of bytes from the variable argument list for the long long argument: 

long long a = 1;
const char msg[] = "Default message";
/* ... */
printf("%lld %s", a, msg);
Noncompliant Code Example ( NULL)

The C Standard allows NULL to be either an integer constant or a pointer constant. While passing NULL as an argument to a function with a fixed number of arguments will cause NULL to be cast to the appropriate pointer type, when it is passed as a variadic argument, this will not happen if  sizeof(NULL) != sizeof(void *). This is possible for several reasons:

  • Pointers and ints may have different sizes on a platform where NULL is an integer constant
  • The platform may have different pointer types with different sizes on a platform. In that case, if NULL is a void pointer, it is the same size as a pointer to char (C11 section 6.2.5, paragraph 28), which might be sized differently than the required pointer type.

On either such platform, the following code will have  undefined behavior: 

char* string = NULL;
printf("%s %d\n", string, 1);

On a system with 32-bit int and 64-bit pointers, printf() may interpret the NULL as high-order bits of the pointer and the third argument 1 as the low-order bits of the pointer. In this case, printf() will print a pointer with the value 0x00000001 and then attempt to read an additional argument for the %d conversion specifier, which was not provided.

Compliant Solution ( NULL)

This compliant solution avoids sending NULL to printf(): 

char* string = NULL;
printf("%s %d\n", (string ? string : "null"), 1);
Risk Assessment

Inconsistent typing in variadic functions can result in abnormal program termination or unintended information disclosure.

Recommendation Severity Likelihood Remediation Cost Priority Level
DCL11-C High Probable High P6 L2
Related Guidelines
ISO/IEC TR 24772:2013 Type System [IHN]
Subprogram Signature Mismatch [OTR]
MISRA C:2012 Rule 17.1 (required)
Excerpt from SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems (2016 Edition) and SEI CERT C Coding Standard [https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/recommendations/declarations-and-initialization-dcl/dcl11-c], Copyright (C) 1995-2026 Carnegie Mellon University. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key

Text

Severity

Disabled

arg_type_mismatch

{} expects argument of type ‘{}’, but argument {} has type ‘{}’

None

False

invalid_conversion

Invalid or non-standard conversion specification

None

False

matching_arg_expected

{} expects a matching ‘{}’ argument

None

False

precision_for_conversion

Precision must not be used with %{} conversion specifier

None

False

too_many_args

Too many arguments for format.

None

False

unsupported_assignment_suppression

%n does not support assignment suppression

None

False

unsupported_field_width

%n does not support field width

None

False

unsupported_flags

%n does not support flags

None

False

unsupported_flags_modifiers

Cannot use any flags or modifiers with ‘%%’

None

False

unsupported_hash

%{} does not support the ‘#’ flag

None

False

unsupported_i_flag

%{} does not support the ‘I’ flag

None

False

unsupported_length_modifier

%{} does not support the ‘{}’ length modifier

None

False

unsupported_tick

%{} does not support the “’” flag

None

False

unsupported_zero

%{} does not support the ‘0’ flag

None

False

Options

allow_extra_args

allow_extra_args : bool = False

Whether to allow additional arguments that are not used by the format string.
 

allow_gnu_extensions

allow_gnu_extensions : bool = True

Whether to allow the GNU extensions to format specifications.
 

allow_unknown_specs

allow_unknown_specs : bool = False

Whether to allow unknown format specifications. It may be necessary to set this option when using implementation-specific extensions. Arguments are not checked when the format string contains unknown format specifications.
 

functions

functions

Type: dict[bauhaus.analysis.config.QualifiedName, typing.Tuple[str, int, typing.Optional[int]]]

Default:

{
   '_printf_l': ('printf', 1, 3),
   'fprintf': ('printf', 1, 2),
   'fscanf': ('scanf', 1, 2),
   'printf': ('printf', 0, 1),
   'scanf': ('scanf', 0, 1),
   'snprintf': ('printf', 2, 3),
   'sprintf': ('printf', 1, 2),
   'sscanf': ('scanf', 1, 2),
   'vfprintf': ('printf', 1, None),
   'vfscanf': ('scanf', 1, None),
   'vprintf': ('printf', 0, None),
   'vscanf': ('scanf', 0, None),
   'vsnprintf': ('printf', 2, None),
   'vsprintf': ('printf', 1, None),
   'vsscanf': ('scanf', 1, None)
}
A dictionary mapping the names of the functions to check, to a triple (function_kind, fmt_param_index, arg_start_index) where function_kind is either printf or scanf, fmt_param_index is the index of the format-string parameter, and arg_start_index is the index of the first variadic argument.
 

use_static_semantic_analysis

use_static_semantic_analysis : bool = True

Whether the rule should use the results of the StaticSemanticAnalysis to check buffer sizes. This can produce different findings, as the size of buffer arguments are computed more accurately. This will not enforce StaticSemanticAnalysis to be enabled, but will produce less accurate results if it is not.