SV.FMT_STR.SCAN_PARAMS_WRONGNUM.FEW

Too few arguments in scan function call

In a format string in a scan function call, there should be the same number of parameters as there are format specifications. The SV.FMT_STR.SCAN_PARAMS_WRONGNUM.FEW checker flags the code if there are fewer parameters provided to the scan function than specified in the format string.

Vulnerability and risk

When the syntax of the conversion specification is incorrect, the resulting behavior is undefined, and it may cause unexpected output.

Vulnerable code example

Copy
   void foo(FILE* f, char* pc, int i, char c) {
       fscanf(f, "%c %3s", c);      // too few parameters
       fscanf(f, "%x", &i);
   }

Klocwork reports an error for line 2. Since there should be the same number of specifications and corresponding parameters in the format string, the function is expecting two parameters, one for the %c specification and one for the %s specification, and receives only one. Line 3 isn't flagged, since the format string has one specification and one corresponding parameter.

Fixed code example

Copy
   void foo(FILE* f, char* pc, int i, char c) {
       fscanf(f, "%c %3s", c, pc);
       fscanf(f, "%x", &i);
   }

In the fixed code, line 2 has two specifications and two corresponding parameters.