Rule Definition
The use of snprintf() can make an application vulnerable to format string vulnerability attacks Format string vulnerability attacks fall into three categories: denial of service, reading and writing: Format string vulnerability denial of service attacks are characterized by utilizing multiple instances of the %s format specifier to read data off of the stack until the program attempts to read data from an illegal address, which will cause the program to crash. Format string vulnerability reading attacks typically utilize the %x format specifier to print sections of memory that we do not normally have access to. Format string vulnerability writing attacks utilize the %d, %u or %x format specifiers to overwrite the Instruction Pointer and force execution of user-supplied shell code. The snprintf function is called _snprintf on some platforms.