C and C++


MISC.FMTTYPE : Format String Type Error

Summary

The arguments passed to a printf-like function do not match the format string. Either the number of arguments is incorrect or the types of the arguments are incorrect.

Properties

Class Name Format String Type Error
Significance security
Mnemonic MISC.FMTTYPE
Categories
CWE CWE:628 Function Call with Incorrectly Specified Arguments
  CWE:687 Function Call With Incorrectly Specified Argument Value
  CWE:688 Function Call With Incorrect Variable or Reference as Argument
TS17961 TS17961:5.44-invfmtstr 5.44. Using invalid format strings
CERT-C CERT-C:FIO47-C Use valid format strings
Availability Available for C and C++.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += discard class="Format String Type Error"

Example

#include <stdio.h>

void misc_fmttype(){
    printf("%i", 5);                          /* ok: correct number and type of arguments */

    printf("%i", 5.5);       /* "Format String Type Error" warning issued here:
                              * format string specifies an integer but argument is a float. */

    printf("%i", "5");       /* "Format String Type Error" warning issued here:
                              * format string specifies an integer but argument is a string. */

    printf("%i%i", 5);       /* "Format String Type Error" warning issued here:
                              * format string specifies two arguments but there is only one. */

    printf("%i%i", 5, 5, 5); /* "Format String Type Error" warning issued here:
                              * format string specifies two arguments but there are three. */
}

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.