Note

Formatting functions allow the programmer to construct a string output using a format string and an optional set of arguments. The format string is specified using a simple template language, where the output string is constructed by processing the format string to find format specifiers, and inserting values provided as arguments. For example:

printf("Name: %s, Age: %d", "Freddie", 2);

would produce the output "Name: Freddie, Age: 2”. So far, so good. However, problems arise if there is a mismatch between the number of formatting specifiers, and the number of arguments. For example:

printf("Name: %s, Age: %d", "Freddie");

In this case, we have one more format specifier than we have arguments. In a managed language such as Java or C#, this simply leads to a runtime exception. However, in C/C++, the formatting functions are typically implemented by reading values from the stack without any validation of the number of arguments. This means a mismatch in the number of format specifiers and format arguments can lead to information disclosure.

Of course, in practice this happens rarely with constant formatting strings. Instead, it’s most problematic when the formatting string can be specified by the user, allowing an attacker to provide a formatting string with the wrong number of format specifiers. Furthermore, if an attacker can control the format string, they may be able to provide the %n format specifier, which causes printf to write the number characters in the generated output string to a specified location.

See https://en.wikipedia.org/wiki/Uncontrolled_format_string for more background.

Note

This first query is about finding places where the format specifier is not a constant string. In the CodeQL libraries for C/C++, constant strings are modeled as StringLiteral nodes, so we are looking for calls to format functions where the format specifier argument is not a string literal.

The C/C++ standard libraries include many different formatting functions that may be vulnerable to this particular attack–including printf, snprintf, and others. Furthermore, each of these different formatting functions may include the format string in a different position in the argument list. Instead of laboriously listing all these different variants, we can make use of the standard CodeQL class FormattingFunction, which provides an interface that models common formatting functions in C/C++.

Note

For example, consider the results which appear in /src/ToolBox/SOS/Strike/util.h, between lines 965 and 970:

const char *format = align == AlignLeft ? "%-*.*s" : "%*.*s";

      if (IsDMLEnabled())
          DMLOut(format, width, precision, mValue);
      else
          ExtOut(format, width, precision, mValue);

Here, DMLOut and ExtOut are macros that expand to formatting calls. The format specifier is not constant, in the sense that the format argument is not a string literal. However, it is clearly one of two possible constants, both with the same number of format specifiers.

What we need is a way to determine whether the format argument is ever set to something that is not constant.

Note

Note the scoping of the don’t-care variable “_” in this example: the body of the characteristic predicate is equivalent to:

not exists(DataFlow::Node pred | DataFlow::localFlowStep(pred, this))

which is not the same as:

exists(DataFlow::Node pred | not DataFlow::localFlowStep(pred, this)).