CodeQL documentation

Too many arguments to formatting function

ID: cpp/too-many-format-arguments
Kind: problem
Severity: recommendation
Precision: high
Tags:
   - reliability
   - correctness
Query suites:
   - cpp-security-and-quality.qls

Click to see the query in the CodeQL repository

Each call to the printf function, or a related function, should include the number of arguments defined by the format. Passing the function more arguments than required is usually harmless from a security perspective but indicates that different behavior was intended.

Recommendation

Review the format and arguments expected by the highlighted function calls. Update either the format or the arguments so that the expected number of arguments are passed to the function.

Example

void log_connection_attempt(const char *user_name, char char *ip_address) {
  // This does not print `ip_address`.
  fprintf(stderr, "Connection attempted by '%s'\n", user_name, ip_address);
}

References