Variadic functions accept a variable number of arguments but are problematic. Variadic functions define an implicit contract between the function writer and the function user that allows the function to determine the number of arguments passed in any particular invocation. Failure to enforce this contract may result in undefined behavior. See undefined behavior 141 of Appendix J of the C Standard.
In the following code example, the variadic function average()
calculates the average value of the positive integer arguments passed to the function [Seacord 2013]. The function processes arguments until it encounters an argument with the value of va_eol
(-1
).
enum { va_eol = -1 }; unsigned int average(int first, ...) { unsigned int count = 0; unsigned int sum = 0; int i = first; va_list args; va_start(args, first); while (i != va_eol) { sum += i; count++; i = va_arg(args, int); } va_end(args); return(count ? (sum / count) : 0); } |
Note that va_start()
must be called to initialize the argument list and that va_end()
must be called when finished with a variable argument list.
In this noncompliant code example, the average()
function is called as follows:
int avg = average(1, 4, 6, 4, 1); |
The omission of the va_eol
terminating value means that the function will continue to process values from the stack until it encounters a va_eol
by coincidence or an error occurs.
This compliant solution enforces the contract by adding va_eol
as the final argument:
int avg = average(1, 4, 6, 4, 1, va_eol); |
Another common mistake is to use more conversion specifiers than supplied arguments, as shown in this noncompliant code example:
const char *error_msg = "Resource not available to user."; /* ... */ printf("Error (%s): %s", error_msg); |
This code results in nonexistent arguments being processed by the function, potentially leaking information about the process.
This compliant solution matches the number of format specifiers with the number of variable arguments:
const char *error_msg = "Resource not available to user."; /* ... */ printf("Error: %s", error_msg); |
C functions that accept the variadic primitive va_list
as an argument pose an additional risk. Calls to vfprintf()
, vfscanf()
, vprintf()
, vscanf()
, vsnprintf()
, vsprintf()
, and vsscanf()
use the va_arg()
macro, invalidating the parameterized va_list
. Consequently, once a va_list
is passed as an argument to any of these functions, it cannot be used again without a call to va_end()
followed by a call to va_start()
.
Incorrectly using a variadic function can result in abnormal program termination or unintended information disclosure.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
DCL10-C | High | Probable | High | P6 | L2 |
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Tool | Version | Checker | Description |
---|---|---|---|
Astrée | Supported, but no explicit checker | ||
Helix QAC | C0185, C0184 | ||
Klocwork | SV.FMT_STR.PRINT_PARAMS_WRONGNUM.FEW SV.FMT_STR.PRINT_PARAMS_WRONGNUM.MANY SV.FMT_STR.SCAN_PARAMS_WRONGNUM.FEW SV.FMT_STR.SCAN_PARAMS_WRONGNUM.MANY | ||
LDRA tool suite | 41 S | Enhanced Enforcement | |
Parasoft C/C++test | CERT_C-DCL10-a | The number of format specifiers in the format string and the number of corresponding arguments in the invocation of a string formatting function should be equal | |
PC-lint Plus | 558, 719 | Assistance provided: reports issues involving format strings | |
Polyspace Bug Finder | Checks for format string specifiers and arguments mismatch (rec. partially covered) |
ISO/IEC TR 24772:2013 | Subprogram Signature Mismatch [OTR] |
MISRA C:2012 | Rule 17.1 (required) |
MITRE CWE | CWE-628, Function call with incorrectly specified arguments |
[Seacord 2013] | Chapter 6, "Formatted Output" |