SV.FMT_STR.UNKWN_FORMAT
Unknown format specifier in print function call
A format string in a print function call allows the following format specifiers preceded by a %: d, i, o, u, x, X, f, F, e, E, g, G, a, A, c, s, p, n, C (XCI), S (XSI), and %. The SV.FMT_STR.UNKNOWN_FORMAT checker flags the code if there is an invalid format specifier in the format string.
Vulnerability and risk
When the syntax of the conversion specification is incorrect, the resulting behavior is undefined, and it may cause unexpected output.
Vulnerable code example
Copy
void foo(FILE* f, char* pc, int i, char c) {
fprintf(f, "%c %s %k", c, pc);
fprintf(f, "%o", i);
}
Klocwork reports an error for line 2, since %k is an invalid format specifier.
Fixed code example
Copy
void foo(FILE* f, char* pc, int i, char c) {
fprintf(f, "%c %s", c, pc);
fprintf(f, "%o", i);
}
In the fixed code, the invalid format specifier has been removed.
Related checkers
- SV.FMT_STR.PRINT_FORMAT_MISMATCH.BAD
- SV.FMT_STR.PRINT_FORMAT_MISMATCH.UNDESIRED
- SV.FMT_STR.SCAN_FORMAT_MISMATCH.BAD
- SV.FMT_STR.SCAN_FORMAT_MISMATCH.UNDESIRED
- SV.FMT_STR.PRINT_IMPROP_LENGTH
- SV.FMT_STR.PRINT_PARAMS_WRONGNUM.FEW
- SV.FMT_STR.PRINT_PARAMS_WRONGNUM.MANY
- SV.FMT_STR.SCAN_IMPROP_LENGTH
- SV.FMT_STR.SCAN_PARAMS_WRONGNUM.FEW
- SV.FMT_STR.SCAN_PARAMS_WRONGNUM.MANY
- SV.FMT_STR.UNKWN_FORMAT