SV.FMT_STR.PRINT_IMPROP_LENGTHIncompatible length modifierIn certain types of format specifications, length modifiers for parameters, such as h, l, or L, can be used in the format string. The SV.FMT_STR.PRINT_IMPROP_LENGTH checker produces a warning if a length modifier can't be used with the given format specifier-for example, in the specification %hf, the h length modifier doesn't make any sense when used with the %f format specifier. Vulnerability and riskA compiler normally ignores the incompatible use of length modifiers. However, such use cases may show that a developer intended to use a different format specification and made a mistake, so the Klocwork warning allows the designer to consider the change to the correct specification. Mitigation and preventionThe compatibility of parameters and length modifiers depends on the particular compiler you're using, so it's best to check compiler-specific help or documentation, such as the MSDN web site or the appropriate fprintf Linux man page. A general resource document is the CERT site's article, FIO00-C: Take care when creating format strings. Related checkers
External guidance |