Secure Coding in C and C++

Chapter 6 Formatted Output

Catherine: “Why commit Evil?”Gtz: “Because Good has already been done.”Catherine: “Who has done it?”Gtz: “God the Father. I, on the other hand, am improvising.”

—Jean-Paul Sartre, The Devil and the Good Lord,Act IV, sc. 4, Gallimard (1951).

The C99 standard defines formatted output functions that accept a variable number of arguments, including a format string.¹ Examples of formatted output functions include printf() and sprintf().

1. Formatted output originated in FORTRAN and found its way into C in 1972 with the portable I/O package described in an internal memorandum written by M. E. Lesk in 1973 regarding “A Portable I/O package.” This package was reworked and became the C standard I/O functions.

Figure 6–1 shows ...