Secure Coding in C and C++, Second Edition

Chapter 6. Formatted Output

Catherine: “Why commit Evil?” Gtz: “Because Good has already been done.” Catherine: “Who has done it?” Gtz: “God the Father. I, on the other hand, am improvising.”

—Jean-Paul Sartre, The Devil and the Good Lord, act IV, scene 4

The C Standard defines formatted output functions that accept a variable number of arguments, including a format string.¹ Examples of formatted output functions include printf() and sprintf().

1. Formatted output originated in Fortran and found its way into C in 1972 with the portable I/O package described in an internal memorandum written by M. E. Lesk in 1973 regarding “A Portable I/O package.” This package was reworked and became the C Standard I/O functions.

Example 6.1 shows a C program ...