0

My question is about the behavior after a printf with a missing argument:

printf("%s blah blah %d", int); // integer was given as argument (and not int written)

I already know that if there are insufficient arguments for the format, the behavior is undefined.

The question is whether it is undefined for the printf outcome or for the whole program?

  • A crash can happen when %s tried to read from unauthorized memory address. (it happened to me)
  • Can a crash happen [long] after the printf complete? (printed some garbage string and an integer)

Edit:

To clarify I'm not asking about compilation errors or warnings, nor can a program crash when executing this line. The question is can this line make the program crash randomly after this line already executed.

3
  • 4
    Undefined behavior can be retroactive. The part of the execution trace that comes before the undefined behavior can be messed up too. Sep 30, 2012 at 9:44
  • 2
    Your code snippet is a syntax error; int is a type, not a valid argument. Sep 30, 2012 at 11:03
  • 1
    I wrote int since it is a int varible that was given as an argument and not a string pointer (char*).
    – Ofir Luzon
    Sep 30, 2012 at 11:52

2 Answers 2

1

It is undefined for the whole program.

In fact it is undefined before even the program exists: it is undefined what the compiler itself does in presence of the text printf("%s blah blah %d", int);

2
  • 2
    Except that the compiler has to diagnose the syntax error (which was probably unintentional on the part of the OP). Sep 30, 2012 at 11:04
  • It's pretty obvious that the OP was asking about that parameter being an int, not that it was the int keyword. Sep 30, 2012 at 18:28
0

Basically for the whole program. Printf starts taking arguments off the stack and, in this case, takes an int worth too much. That's usually something like the return address. So when the printf returns, it returns to whatever random number happens to be next on the stack. The usual result -- if you're lucky -- is a segmentation fault.

Because it pushes arguments onto the stack, it pops them off, so it tries to get the int first.

If you're not lucky, it finds an addressable chunk of code. That leads to your second case, where the address becomes the address of that hash of random characters. Now it's going to try to print a string until it find a random NUL character.

Update

As Joachim points out, the specifics of this are determined by the calling convention, so let's make an explicit example. When the printf function is to be called, either the return address is pushed first or its pushed last. We assume it's pushed first (more common on the usual architecture), so this call is going to need PUSH return-address, PUSH address of the format string, PUSH an int value -- let's say 42. That gives us this stack:

RTN ADDR
ADDR OF STRING
42

and leaves the stack pointer SP pointing to the next location on the stack.

Now the printf starts to interpret the string. It looks for the address of the int parameter, and figures out it's SP-1. So the address of the string parameter must be SP-2 ... but that's the address of the format string, since there is no string parameter. Then when it looks for the address of the format string, it wants to find SP-3, but that's the return address, an address of executable code. That should, on most any machine, cause a segmentation fault.

If you go through the other options for calling convention, you'll find every one of them looks at some wrong thing, because no matter what, printf thinks it needs to refer to three things off the stack, not the two it has.

5
  • 1
    Um... I'm not sure I'm understanding you correctly, but using for exampe the cdecl calling convention, it's the caller that both pushes and pops arguments (and then calls so the return address is always last pushed), so you shouldn't be able to get a mismatch and return to the wrong address. Am I misreading what you're saying? Sep 30, 2012 at 9:52
  • Joachim, see update above. The real point is that the calling convention may determine what wrong thing is used, but it will always be wrong because printf will always be looking for three things when only two were provided. Sep 30, 2012 at 18:41
  • The C standard does not require an implementation to use a stack and modern ABIs don't neccessarily put at least the first arguments on the stack, even if there is one (e.g. x64, AAPCS), It is UB, nothing else. Jan 9, 2017 at 22:46
  • @Olaf read the comment directly above yours. The real point is that the calling convention may determine what wrong thing is used, but it will always be wrong because printf will always be looking for three things when only two were provided Then note the answer is four years old. If you'd like to add another answer, please do. Jan 10, 2017 at 0:26
  • @CharlieMartin I did notice the age of both, Q&A. We just have a recent dup closed (that's why I noticed this) and so I try to help correct it, A new answer would not make much sense, exactly because of the age. Jan 10, 2017 at 0:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.