Click here to Skip to main content
15,507,388 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
We use Veracode for static analysis, and it reported following issue in our code:

This function expects a certain number of parameters based on the syntax of the format string, but the wrong amount are specified to the eventual variable length parameter functions call.

Ensure that the number of parameters matches the number of placeholders in the format string.


Below is the offending line:

C++
CString cs;
char arr[1024];
sprintf_s(arr, sizeof(arr), "<html>\r\n"
        "<head>\r\n"
        "<title>REPORT %s</title>\r\n"
        "</head>\r\n"
        "<body bgcolor=#ffffff>\r\n"
        "<table border=1 cellspacing=0>\r\n"
        "<tr><th bgcolor=#a0ffff colspan=41>REPORT %s</th></tr>\r\n",
        (LPCSTR)cs, (LPCSTR)cs);


I do not see what is the erroneous part of the format string, can you please help?

What I have tried:

I have checked official MSDN documentation for sprintf_s, it referred me to this format specifier page.

After double checking format string against the above page, I found no problem.

I have tried below as well, but got the same error again:

C++
char format_string[] = "<html>\r\n"
        "<head>\r\n"
        "<title>REPORT %s</title>\r\n"
        "</head>\r\n"
        "<body bgcolor=#ffffff>\r\n"
        "<table border=1 cellspacing=0>\r\n"
        "<tr><th bgcolor=#a0ffff colspan=41>REPORT %s</th></tr>\r\n"
CString cs;
char arr[1024];
sprintf_s(arr, sizeof(arr), format_string,
        (LPCSTR)cs, (LPCSTR)cs);
Posted
Updated 30-Dec-20 10:39am
Comments
CPallini 31-Dec-20 1:58am    
I confirm what already said by Rick. Your code is correct and Veracode is wrong.

1 solution

The issue here is Veracode is falsely reporting an error. Your format string specifies two arguments and you supplied two arguments so it is incorrect.

I hope you see that your arguments will be an empty string since cs was never set to anything. As an experiment, try this :
C++
PCTSTR arg = "report name";
const int bufferSize = 1023;
char buffer[ bufferSize+1 ] = { 0 };
sprintf_s( buffer, bufferSize, format_string, arg, arg );
Sometimes tools can get confused by casts so this approach has no casts.
 
Share this answer
 
Comments
CPallini 30-Dec-20 16:40pm    
5.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900