A format string in a scan function call allows a number of format specifiers preceded by a %. The most commonly used specifiers are d, i, o, u, x, X, f, g, G, c, s,(space), lf, and Lf. The SV.FMT_STR.UNKNOWN_FORMAT.SCAN checker flags the code if there is an invalid format specifier in the format string.

Vulnerability and risk

When the syntax of the conversion specification is incorrect, the resulting behavior is undefined, and it may cause unexpected output.

Vulnerable code example

1  void foo(FILE* f, char* pc, int i, char c) {
2      fscanf(f, "%c %4s %k", &c, pc, i);      // unknown specifier 'k'
3      fscanf(f, "%o", &i);
4  }

Klocwork reports an error for line 2, since %k is an invalid format specifier.

Fixed code example

  
1  void foo(FILE* f, char* pc, int i, char c) {
2      fscanf(f, "%c %4s %i", &c, pc, i);      // unknown specifier 'k' replaced with proper integer specifier 'i'
3      fscanf(f, "%o", &i);
4  }

In the fixed code, the invalid format specifier has been removed.

SV.FMT_STR.UNKWN_FORMAT.SCAN

Unknown format specifier in scan function call

Vulnerability and risk

Vulnerable code example

Fixed code example

Related checkers

External guidance