IO.INJ.FMT : Format String Injection

Summary

A potentially-tainted value is used in a format string argument.

This class is a strict subset of Format String.

Properties

WARNING_FILTER += discard class="Format String Injection"

Example

#include <stdio.h>

void tainted_input_as_fmt(void){
    char greeting[18] = "hello";
    char buf[12];
    printf("what is your name?\n");
    if (!fgets(buf, 12, stdin)) return;
    printf(buf);      /* 'Format String Injection' warning issued here
                       * - first argument to printf() has file taint
                       * ('Format String' warning also issued here)
                       */
}

void tainted_input_with_fmt(void){
    char greeting[18] = "hello";
    char buf[12];
    printf("what is your name?\n");
    if (!fgets(buf, 12, stdin)) return;
    printf("%s", buf);                /* ok: first argument to printf() is a string literal */
}

Notes

Untrusted or omitted format strings may not cause any problems during normal running of software, but they nonetheless represent a security vulnerability. In the example shown no problems will arise so long as the string read from standard input is actually a person's name, but an attacker might instead provide the input "%x %x %x %x" (a format string, but not from a trusted source). There are no unsigned integer (%x) arguments provided in this call to printf, but because printf can take a variable number of arguments this does not cause a problem. Instead the program simply computes the stack offset where additional arguments would have been located, had there been any, and prints four unsigned integers starting from that position. Because there were no additional arguments those stack locations will contain other, potentially sensitive data that has now been revealed to the attacker.

In the worst case format string attacks can crash the program, cause malicious code to be executed or allow the attacker to gain root privileges.

Triggers

CodeSonar ships with library models that allow it to recognize a large number of functions that take a format string parameter. Some examples are shown in the table below. If one of these functions is called with a tainted value in the format string parameter position, a warning will be issued.

If you have created a custom library model for some function f() in terms of one of these existing models, calls to f() will also be capable of triggering Format String Injection warnings.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

• ASSUME_FUNCPTR_PARAMETERS_MAYBE_FREED
• ASSUME_FUNCPTR_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_FUNCPTR_PARAMETERS_MAYBE_MODIFIED
• ASSUME_OTHER_PARAMETERS_MAYBE_FREED
• ASSUME_OTHER_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_OTHER_PARAMETERS_MAYBE_MODIFIED
• ASSUME_UNDEFINED_PARAMETERS_MAYBE_FREED
• ASSUME_UNDEFINED_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_UNDEFINED_PARAMETERS_MAYBE_MODIFIED
• ASSUME_VARARG_PARAMETERS_MAYBE_FREED
• ASSUME_VARARG_PARAMETERS_MAYBE_INITIALIZED
• ASSUME_VARARG_PARAMETERS_MAYBE_MODIFIED
• CALL_SITE_EXPANSIONS
• CALL_SITE_EXPANSION_BOUND
• CPU_SPEED_ADJUSTMENT
• DISABLED_TAINT_KINDS
• DIV_BY_ZERO_CRASHES
• DIV_OVERFLOW_CRASHES
• DP_REFINEMENT_APPROXIMATE
• DP_REFINEMENT_APPROXIMATE_DISMISS
• DP_REFINEMENT_APPROXIMATE_DISMISS_TIMEOUT
• DP_REFINEMENT_APPROXIMATE_TIMEOUT
• DP_REFINEMENT_EXACT
• DP_REFINEMENT_EXACT_DISMISS
• DP_REFINEMENT_EXACT_DISMISS_TIMEOUT
• DP_REFINEMENT_EXACT_TIMEOUT
• EXPLORE_MORE_LOOP_PATHS
• EXPLORE_SELF_ASSIGNMENT
• FLOAT_IS_ADVERSARIAL
• FUNCTION_MAP
• FUNCTION_POINTER_RESOLUTION
• IGNORE_CPP_CODE
• IMPLICIT_INITIALIZER_ELT_LIMIT
• INFER_CONST
• LOOP_COUNTER_DISTRUST
• LOOP_TAINT_TRANSFER
• MAX_ALLOCATION_SIZE
• MAX_CLOBBERED_FIELDS
• MAX_COPIED_FIELDS
• MAX_EXPRESSION_COMPLEXITY
• MAX_MODIFIED_VALUES
• MAX_PERCENT_F_CHARACTERS
• MAX_PERCENT_LF_CHARACTERS
• MAX_POINTER_ANALYSIS_PASSES
• MAX_SUMMARIES_PER_PROCEDURE
• NULL_POINTER_DEREF_CRASHES
• NULL_SENTINEL_CHAR_SIZE
• PARAMETER_EVALUATION_ORDER
• REACHABILITY_ROOTS
• REFINEMENT_BARRIER_PERIOD
• REPORT_SIMILAR_WARNINGS
• ROLLBACK_SUMMARIES_ON_ABORT
• SEARCH_BOUND
• SEARCH_BOUND_NOISE_THRESHOLD
• SYSTEM_INCLUDE_PATHS
• TAINT_CALLSITE_EXPANSION_EFFORT
• TAINT_MAX_MODIFIED_VALUES
• TAINT_MAX_WARNING_PATH_LENGTH
• TAINT_SEARCH_BOUND
• TIME_LIMIT_RESOLVE
• TIME_LIMIT_TAINT_REFINE
• TIME_LIMIT_TAINT_REFINE_PER_PROCEDURE
• UNINITIALIZED_GLOBALS
• VOLATILE_TREATMENT
• WARNING_FILTER