{"id":6841,"date":"2015-06-22T17:47:00","date_gmt":"2015-06-23T00:47:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/vcblog\/2015\/06\/22\/format-specifiers-checking\/"},"modified":"2019-07-31T09:25:41","modified_gmt":"2019-07-31T09:25:41","slug":"format-specifiers-checking","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/cppblog\/format-specifiers-checking\/","title":{"rendered":"Format Specifiers Checking"},"content":{"rendered":"

By popular request, in Visual Studio 2015 RTM, we’ve implemented the checking of arguments given to printf<\/span>\/scanf<\/span> and their variations in the C standard library. You can try the examples from this post in our online compiler<\/a>.<\/p>\n

Summary<\/h2>\n

Here is a list of all the formatting warnings that were introduced:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

State<\/span> <\/strong><\/p>\n<\/td>\n

\n

Level<\/span> <\/strong><\/p>\n<\/td>\n

\n

Number<\/span> <\/strong><\/p>\n<\/td>\n

\n

Text<\/span> <\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

On<\/span><\/p>\n<\/td>\n

\n

W1<\/span><\/p>\n<\/td>\n

\n

C4473<\/a><\/p>\n<\/td>\n

\n

‘<function>’ : not enough arguments passed for format string <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

On<\/span><\/p>\n<\/td>\n

\n

W3<\/span><\/p>\n<\/td>\n

\n

C4474<\/a><\/p>\n<\/td>\n

\n

‘<function>’ : too many arguments passed for format string <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

On<\/span><\/p>\n<\/td>\n

\n

W3<\/span><\/p>\n<\/td>\n

\n

C4475<\/a><\/p>\n<\/td>\n

\n

‘<function>’ : length modifier ‘<length>’ cannot be used with type field character ‘<conversion-specifier>’ in format specifier <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

On<\/span><\/p>\n<\/td>\n

\n

W3<\/span><\/p>\n<\/td>\n

\n

C4476<\/a><\/p>\n<\/td>\n

\n

‘<function>’ : unknown type field character ‘<conversion-specifier>’ in format specifier <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

On<\/span><\/p>\n<\/td>\n

\n

W1<\/span><\/p>\n<\/td>\n

\n

C4477<\/a><\/p>\n<\/td>\n

\n

‘<function>’ : format string ‘<format-string>’ requires an argument of type ‘<type>’, but variadic argument <position> has type ‘<type>’ <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

On<\/span><\/p>\n<\/td>\n

\n

W1<\/span><\/p>\n<\/td>\n

\n

C4478<\/a><\/p>\n<\/td>\n

\n

‘<function>’ : positional and non-positional placeholders cannot be mixed in the same format string <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

OFF<\/span><\/p>\n<\/td>\n

\n

W4<\/span><\/p>\n<\/td>\n

\n

C4774<\/a><\/p>\n<\/td>\n

\n

‘<function>’ : format string expected in argument <position> is not a string literal <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

On<\/span><\/p>\n<\/td>\n

\n

W3<\/span><\/p>\n<\/td>\n

\n

C4775<\/a><\/p>\n<\/td>\n

\n

nonstandard extension used in format string ‘<\/a><format-string>’ of function ‘<function>’ <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

On<\/span><\/p>\n<\/td>\n

\n

W1<\/span><\/p>\n<\/td>\n

\n

C4776<\/a><\/p>\n<\/td>\n

\n

‘%<conversion-specifier>’ is not allowed in the format string of function ‘<function>’ <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

OFF<\/span><\/p>\n<\/td>\n

\n

W4<\/span><\/p>\n<\/td>\n

\n

C4777<\/a><\/p>\n<\/td>\n

\n

‘<function>’ : format string ‘<format-string>’ requires an argument of type ‘<type>’, but variadic argument <position> has type ‘<type>’ <\/span><\/p>\n<\/td>\n<\/tr>\n

\n

On<\/span><\/p>\n<\/td>\n

\n

W3<\/span><\/p>\n<\/td>\n

\n

C4778<\/a><\/p>\n<\/td>\n

\n

‘<function>’ : unterminated format string ‘<format-string>’<\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/a>Example 1<\/h2>\n

Consider the following snippet taken from real code:<\/p>\n

\n

wchar_t const<\/span> * str = …<\/span>;<\/span>\/\/ Some string to parse<\/span><\/p>\n

char<\/span> buf[<\/span>10<\/span>];<\/span><\/p>\n

wchar_t<\/span> wbf;<\/span><\/p>\n

swscanf_s(str, L<\/span>“%10c %1C”<\/span>, buf, <\/span>sizeof<\/span>(buf), &wbf);<\/span><\/p>\n

 <\/span><\/p>\n<\/blockquote>\n

Compiling it with cl.exe and no additional flags (default warning level is 1) will give you 3 warnings (colors are used for clarity of presentation):<\/p>\n

\n

<\/a> warning C4477<\/span> : ‘swscanf_s’ : format string ‘%10c’ requires an argument of type ‘wchar_t *’, but variadic argument 1 has type ‘char *’
note: this argument is used by a <\/span>conversion specifier<\/span>
<\/span> note: consider using ‘%hc’ in the format string
note: consider using ‘%Tc’ in the format string
<\/span> note: consider defining _CRT_STDIO_ISO_WIDE_SPECIFIERS if C99 standard semantics is required <\/span><\/p>\n<\/p><\/div>\n

The first warning indicates a mismatch between the type of the expected and the actual argument in the context of swscanf_s<\/span>. Note that the same actual argument might be valid for that format specifier if you had called a different function (for example, sscanf_s<\/span>), which is why we include the name of the function in these newly introduced warning messages. If the given conversion specifier would match the actual argument with different length modifiers, then we will list those combinations as suggestions. Note that following these suggestions may not always be the right thing to do, because the conversion specifier or the type of the argument may have to be changed. We will not suggest other conversion specifiers because changing the conversion specifier itself will usually lead to semantic changes, which requires insight into the logic of the program.<\/p>\n

We chose to refer to the positions of arguments as relative to the beginning of the variadic arguments instead of relative to all the arguments. We wanted this numbering to be consistent with the numbering used by positional arguments in _p functions <\/a>, and we found this scheme easier to work with because variadic arguments tend to immediately follow the format string (except in the case of _l<\/span> functions).<\/p>\n

\n

warning C4477: ‘swscanf_s’ : format string ‘%1C’ requires an argument of type ‘char *’, but variadic argument 3 has type ‘wchar_t *’
note: this argument is used by a <\/span> conversion specifier
<\/span> note: consider using ‘%lC’ in the format string
<\/span> note: consider using ‘%llC’ in the format string
note: consider using ‘%LC’ in the format string
note: consider using ‘%wC’ in the format string <\/span><\/p>\n<\/p><\/div>\n

If you use \/Za during compilation to disable Microsoft extensions, you will notice that notes suggesting the use of non-standard format specifiers (marked with gray color<\/span> above) don’t appear, and that you get one additional warning:<\/p>\n

\n

<\/a> warning C4775<\/span> : nonstandard extension used in format string ‘%1C’ of function ‘swscanf_s’
note: the combination of length modifier ” with type field character ‘C’ is non standard <\/span><\/p>\n<\/p><\/div>\n

If you compile for x64, where size_t is defined to be typedef<\/span> unsigned<\/span> __int64<\/span> size_t; <\/span>you will also get:<\/p>\n

\n

warning C4477: ‘swscanf_s’ : format string ‘%10c’ requires an argument of type ‘int’, but variadic argument 2 has type ‘size_t’
note: this argument is used as a <\/span>buffer size<\/span><\/p>\n<\/p><\/div>\n

The problem here is that the buffer size is expected to be of type int<\/span>, which has 4 bytes on x64, but the actual argument has type size_t<\/span>, which occupies 8 bytes on x64. In some cases, it is possible to get this warning on x86 as well, but you will need to enable warning C4777, which is off by default. To do so, compile with \/w14777 or \/Wall. Unfortunately, C4777 will not help you in this specific case, because the value will have to be declared with type std::size_t<\/span> for us to detect the potential issue, while here the type of the expression sizeof(buf)<\/span> is of unnamed type, which is also the underlying type of size_t<\/span>.<\/p>\n

Some format specifiers can consume up to 3 arguments from the stack, depending on the function. Because of this, it might be confusing at first to encounter a warni\nng that indicates that a format specifier %s<\/span> expects an argument of type int<\/span>. To reduce confusion, we added notes that indicate what such arguments are used for in a given context, with examples highlighted in red<\/span> above and below. These notes explain whether the argument is used by the conversion specifier itself, as a required buffer size or as a width or precision field.<\/p>\n

\n

<\/a> warning C4473<\/span> : ‘swscanf_s’ : not enough arguments passed for format string
note: placeholders and their parameters expect 4 variadic arguments, but 3 were provided
note: the missing variadic argument 4 is required by format string ‘%1C’
note: this argument is used as a <\/span>buffer size<\/span><\/p>\n<\/p><\/div>\n

Missing variadic arguments can be as big of a security concern as incorrect types, because they may cause your program to read garbage from the stack. To reflect the severity of these issues, we created C4473 as a level 1 warning.<\/p>\n

Note that in earlier previews of Visual Studio 2015, C4473 was known as C4317, while <\/a>C4474 used to be C4422 and C4776 was C4426. Please make sure to update your pragmas or build scripts if you were suppressing or disabling these warnings using their old numbers.<\/p>\n

Example 2<\/h2>\n

Consider another simple example we found in “real world” code:<\/p>\n

\n

const<\/span> char<\/span>* path= <\/span> “PATH=%WindowsSdkDir%bin\\\\%_ARCH% ;%PATH%”<\/span>;<\/span><\/p>\n

printf_s(path);<\/span><\/p>\n<\/blockquote>\n

Compiling this with default flags wouldn’t result in any diagnostic messages, giving you a false sense of security, but you can clearly see that there are problems here. Unfortunately, always giving a warning when a format string is not a string literal turned out to generate too many warnings on valid use cases (e.g. localization), so as a compromise we decided to provide this warning as off by default. To enable it, you need to pass \/w14774 or \/Wall, after which you will get:<\/p>\n

\n

<\/a> warning<\/span> <\/a> C4774<\/span> : ‘printf_s’ : format string expected in argument 1 is not a string literal
note: e.g. instead of printf(name); use printf(“%s”, name); because format specifiers in ‘name’ may pose a security issue
note: consider using <\/span>constexpr<\/span> specifier for named string literals<\/span><\/p>\n<\/p><\/div>\n

We recommend enabling this warning at least occasionally to detect all the places where format checking is not actually happening due to non-literal format strings. The important message here is the second note, which suggests that you use constexpr<\/span> instead of const<\/span>. Doing so allows us to evaluate ‘path’ at compile time and thus perform format checking at the point of its use:<\/p>\n

\n

<\/a> warning<\/span> <\/a> C4476<\/span> : ‘printf_s’ : unknown type field character ‘W’ in format specifier
warning C4476: ‘printf_s’ : unknown type field character ‘b’ in format specifier
warning C4476: ‘printf_s’ : unknown type field character ‘_’ in format specifier
warning C4476: ‘printf_s’ : unknown type field character ‘;’ in format specifier
warning C4476: ‘printf_s’ : unknown type field character ‘P’ in format specifier
<\/a>warning <\/a>C4778: ‘printf_s’ : unterminated format string ‘%’ <\/span><\/p>\n<\/p><\/div>\n

The solution is to simply use %% instead of %, but, surprisingly, we’ve seen way too many occurrences of this bug in real code. The problem can be even more subtle once you realize that ‘ ‘ (space) is a valid printf flag (see the 4th<\/sup> warning about ‘;’<\/span> above)<\/p>\n

Example 3<\/h2>\n

Consider another example:<\/p>\n

\n

struct<\/span> HTMLElement<\/span><\/p>\n

{<\/span><\/p>\n

    const<\/span> char<\/span>* tag;<\/span><\/p>\n

    virtual<\/span> std::string content()<\/span> const<\/span> =<\/span> 0<\/span>;<\/span><\/p>\n

};<\/span><\/p>\n

 <\/span><\/p>\n

int<\/span> n;<\/span><\/p>\n

HTMLElement* elem = <\/span>…<\/span>;<\/span><\/p>\n

_tprintf_p(_T(<\/span>“<%hhs>%hhs%n<\/%1$hhs>”<\/span>), elem->tag, elem->content().c_str(), &n); <\/span><\/p>\n<\/blockquote>\n

This snippet tries to print the content of an html element while at the same time counting how many characters we printed before printing the closing tag. The closing tag is printed via a positional format specifier (“%1$hhs”<\/span>) that refers to the first argument (elem->tag<\/span>). And since we are in a _t<\/span> function, we try to ensure it treats “%s<\/span>” as a narrow string by writing “hh<\/span>”. What we get is the following:<\/p>\n

\n

<\/a> warning<\/span> <\/a> C4475<\/span> : ‘_printf_p’ : length modifier ‘hh’ cannot be used with type field character ‘s’ in format specifier
<\/a>warning <\/a><\/a>C4776: ‘%n’ is not allowed in the format string of function ‘_printf_p’
<\/a>warning <\/a>C4478: ‘_printf_p’ : positional and non-positional placeholders cannot be mixed in the same format string <\/span><\/p>\n<\/p><\/div>\n

The first warning says that “hh<\/span>” is not a valid length modifier for “%s<\/span>”. The second warning tells you that “%n<\/span>” is disallowed in this function. The last warning reminds you that you are not allowed to mix positional and non-positional arguments.<\/p>\n

Example 4<\/h2>\n

When we tested these warnings, we noticed that a lot of developers where using the following code to print the value of a pointer:<\/p>\n

\n

const<\/span> char<\/span>* ptr = <\/span>…<\/span>;<\/span> \/\/ Some pointer<\/span><\/p>\n

printf(<\/span>“%08X”<\/span>, ptr);<\/span><\/p>\n<\/blockquote>\n

We are not sure why this pattern was prevalent to using the standard %p format specifier, but it was so common that we felt the need to elaborate on it. Compiling this code as is on x86 would give you the following warning:<\/p>\n

\n

warning C4477: ‘printf’ : format string ‘%08X’ requires an argument of type ‘unsigned int’, but variadic argument 1 has type ‘const char *’ <\/span><\/p>\n<\/p><\/div>\n

Compiling it on x64 additionally produces:<\/p>\n

\n

warning C4313: ‘printf’: ‘%X’ in format string conflicts with argument 1 of type ‘const char *’ <\/span><\/p>\n<\/p><\/div>\n

C4313 is an existing warning that was designed to detect integer\/pointer size mismatches. We can get rid of this warning on x86 by converting the pointer to an integral type of the same size as pointers:<\/p>\n

\n

printf(<\/span>“%08X”<\/span>, reinterpret_cast<\/span><<\/span>intptr_t<\/span>>(ptr));<\/span><\/p>\n<\/blockquote>\n

This does not work on x64, because there intptr_t is 8 bytes, while unsigned int is 4.<\/p>\n

\n

warning C4477: ‘printf’ : format string ‘%08X’ requires an argument of type ‘unsigned int’, but variadic argument 1 has type ‘intptr_t’
note: consider using ‘%IX’ in the format string <\/span><\/p>\n<\/p><\/div>\n

Casting this way also results in printing a truncated value e.g. 9515CED0 instead of the 000000<\/a>E2<\/span>9515CED0 produced by %p on x64.<\/p>\n

To get a warning about such potential truncations on x86, you have to explicitly enable the off-by-default warning C4777 (e.g. by passing \/w14777 on command line):<\/p>\n

\n

<\/a> warning<\/span> <\/a><\/a>C4777<\/span> : ‘printf’ : format string ‘%08X’ requires an argument of type ‘unsigned int’, but variadic argument 1 has type ‘intptr_t’
note: the sizes of types ‘intptr_t’ and ‘unsigned int’ might differ on other platforms
note: consider using ‘%IX’ in the format string <\/span><\/p>\n<\/p><\/div>\n

The text of the warning C4777 is exactly the same as C4477, but it is given in noisier contexts where the expected and actual types are related on the target platform. For example, int<\/span> vs. long<\/span> or double<\/span> vs. long double<\/span> on many architectures targeted by Microsoft have the same set of values, while technically being different built-in types. We found in our testing that the number of such mismatches was very high compared to the number of more serious mismatches, with a ratio of about 10 to 1. So, we decided to distinguish the two cases and have the noisier case be off by default.<\/p>\n

Following the note’s suggestion to use the “I<\/span>” length modifier:<\/p>\n

\n

printf(<\/span>“%08IX\\n”<\/span>, reinterpret_cast<\/span><intptr_t<\/span>><\/span><\/span>(ptr));<\/span><\/p>\n<\/blockquote>\n

produces the correct value “E29515CED0” for the above pointer, but this output is not prepended by zeros to reflect the greater number of bits that pointers on x64 have. To alleviate this, we must also pass the width of the field to print:<\/p>\n

\n

const<\/span> size_t<\/span> MACH_PTR_SIZE = <\/span>sizeof<\/span>(<\/span>void<\/span>*);<\/span><\/p>\n

printf(<\/span>“%0*IX\\n”<\/span>, 2*MACH_PTR_SIZE, reinterpret_cast<\/span><intptr_t<\/span>><\/span><\/span>(ptr));<\/span><\/p>\n<\/blockquote>\n

Surprisingly, this gives us another warning (the noisier C4777 on x86 and the stricter C4477 on x64):<\/p>\n

\n

warning C4777: ‘printf’ : format string ‘%0*IX’ requires an argument of type ‘int’, but variadic argument 1 has type ‘size_t’
note: this argument is used as a <\/span>field width<\/span>
note: the sizes of types ‘size_t’ and ‘int’ might differ on other platforms <\/span><\/p>\n<\/p><\/div>\n

which indicates that the field width has to be of type int<\/span>, not size_t<\/span>. Making the following modification:<\/p>\n

\n

printf(<\/span>“%0*IX == %p\\n”<\/span>, <\/span>int<\/span>(2*MACH_PTR_SIZE), reinterpret_cast<\/span><intptr_t<\/span>><\/span><\/span>(ptr), ptr); <\/span><\/p>\n<\/blockquote>\n

finally gets rid of all the warnings and prints the pointer in the same way as using %p<\/span> (in our implementation) both on x86 and x64. If you prefer a standard length modifier, you can always go with the combination of %tX<\/span> and ptrdiff_t<\/span> instead of %IX<\/span> and intptr_t<\/span>.<\/p>\n

What Next?<\/h2>\n

Currently, the checking of format specifiers is only done for a predefined set of CRT functions and is not available for user-defined functions that would also benefit from similar checks. If there is enough interest, we will consider extending these warnings to work on such user-defined functions. We would also like to hear about other bugs in the printf<\/span>\/scanf<\/span> family of functions that you would like the compiler to detect. Feel free to email me (yuriysol from Microsoft) or comment below and provide any feedback you can think of. Thank you!<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"

By popular request, in Visual Studio 2015 RTM, we’ve implemented the checking of arguments given to printf\/scanf and their variations in the C standard library. You can try the examples from this post in our online compiler. Summary Here is a list of all the formatting warnings that were introduced: State Level Number Text On […]<\/p>\n","protected":false},"author":6384,"featured_media":35994,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[239],"tags":[140,194],"class_list":["post-6841","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-diagnostics","tag-c","tag-diagnostics"],"acf":[],"blog_post_summary":"

By popular request, in Visual Studio 2015 RTM, we’ve implemented the checking of arguments given to printf\/scanf and their variations in the C standard library. You can try the examples from this post in our online compiler. Summary Here is a list of all the formatting warnings that were introduced: State Level Number Text On […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts\/6841","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/users\/6384"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/comments?post=6841"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/posts\/6841\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/media\/35994"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/media?parent=6841"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/categories?post=6841"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cppblog\/wp-json\/wp\/v2\/tags?post=6841"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}