The SV.FMT_STR.PRINT_FORMAT_MISMATCH.UNDESIRED checker flags code in which a print function parameter and the corresponding format-string specification don't match. In these cases, the stack memory block occupied by this parameter matches that expected from the corresponding format-string specification.

Vulnerability and risk

Because the memory block size matches the size expected from the specification, there isn't a chance of memory corruption, but this situation may cause unexpected output. One can also face problems when porting his code to a different platform. In this case those sizes may become different.

Vulnerable code example

1 void foo(FILE* f, char* pc, int i, char c, long l, struct SomeStruct ss) {
2     fprintf(f, "%s", pc);
3     fprintf(f, "%d", pc);// fprintf format mismatch: unexpected parameter type
4     fprintf(f, "%10d", i);
5     fprintf(f, "%hx", i);
6     fprintf(f, "%c", l); // fprintf format mismatch: unexpected parameter type
7     fprintf(f, "%p", i); // fprintf format mismatch: unexpected parameter type
8 }

Klocwork flags errors at lines 3, 6, and 7 to indicate mismatches between the format-string specification and the parameter. The format specification shows that in line 3, an integer is expected, in line 6, a character is expected, and in line 7, a pointer address is expected, and none of the parameters in these lines matches the expectation. However, because there is no memory mismatch, the error is considered UNDESIRED rather than BAD. In contrast, lines 2, 4, and 5 show matched examples of specification and parameter.

Fixed code example

1 void foo(FILE* f, char* pc, int i, char c, long l, struct SomeStruct ss) {
2     fprintf(f, "%s", pc);
3     fprintf(f, "%d", i);
4     fprintf(f, "%10d", i);
5     fprintf(f, "%hx", i);
6     fprintf(f, "%c", c); 
7     fprintf(f, "%p", pc); 
8 }

In the fixed examples, each format specification and parameter correspond.

Related checkers

External guidance

CWE-686: Function Call with Incorrect Argument Type