Too many arguments to formatting function¶
ID: cpp/too-many-format-argumentsKind: problemSecurity severity: Severity: recommendationPrecision: highTags: - reliability - correctnessQuery suites: - cpp-security-and-quality.qls
Click to see the query in the CodeQL repository
Each call to theprintf function, or a related function, should include the number of arguments defined by the format. Passing the function more arguments than required is usually harmless from a security perspective but indicates that different behavior was intended.
Recommendation¶
Review the format and arguments expected by the highlighted function calls. Update either the format or the arguments so that the expected number of arguments are passed to the function.
Example¶
voidlog_connection_attempt(constchar*user_name,charchar*ip_address){// This does not print `ip_address`.fprintf(stderr,"Connection attempted by '%s'\n",user_name,ip_address);}
References¶
CERT C Coding Standard:FIO47-C. Use valid format strings.
Microsoft C Runtime Library Reference:printf, wprintf.