SV.FMT_STR.SCAN_IMPROP_LENGTHIncompatible scan length modifierIn certain types of format specifications, length modifiers for parameters, such as h, l, or L, can be used in the format string. The SV.FMT_STR.SCAN_IMPROP_LENGTH checker produces a warning if a length modifier can't be used with the given format specifier-for example, in the specification %hf, the h length modifier doesn't make any sense when used with the %f format specifier. Vulnerability and riskA compiler normally ignores the incompatible use of length modifiers. However, such use cases may show that a developer intended to use a different format specification and made a mistake, so the Klocwork warning allows the designer to consider the change to the correct specification. Mitigation and preventionThe compatibility of parameters and length modifiers depends on the particular compiler you're using, so it's best to check compiler-specific help or documentation, such as the appropriate fscanf Linux man page or the MSDN web site. A general resource document is the CERT site's article, FIO00-C: Take care when creating format strings. Vulnerable code example
1 void foo(FILE* f, char* pc, int i, long l, struct SomeStruct ss, long double ld) {
2 fscanf(f, "%2hs", pc); // improper use of 'h' modifier
3 fscanf(f, "%lc", &i);
4 fscanf(f, "%10ld", &l);
5 fscanf(f, "%hx", &i);
6 fscanf(f, "%hc", pc); // 'h' modifier used with 'c' type character
7 fscanf(f, "%Lx", &l); // 'L' modifier used with 'x' type character
8 fscanf(f, "%Lf", &ld);
9 }
Klocwork flags errors at lines 2, 6, and 7 to indicate mismatches between the format-string specification and the parameter. The format specification shows that in line 2, a character string is expected, in line 6, a character is expected, and in line 7, a hexadecimal is expected, and none of the modifiers in these lines makes sense with the specifications. In contrast, lines 3, 4, and 5 show examples of specification and modifier that are compatible. Fixed code example
1 void foo(FILE* f, char* pc, int i, long l, struct SomeStruct ss, long double ld) {
2 fscanf(f, "%s", pc);
3 fscanf(f, "%lc", &i);
4 fscanf(f, "%10ld", &l);
5 fscanf(f, "%hx", &i);
6 fscanf(f, "%c", pc);
7 fscanf(f, "%x", &l);
8 fscanf(f, "%Lf", &ld);
9 }
In the fixed code, each format-string specification and the parameter are compatible. Related checkers |