vetkit.c.format-string.non-literal-format
A printf-family function receives a non-constant string as its format and no further arguments; %n / %s in that string read or write arbitrary memory.
Last updated:
Suite: Security
c, cpp
A printf-family function receives a non-constant string as its format and no further arguments; %n / %s in that string read or write arbitrary memory.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Pass the text as an argument to a constant format, e.g. printf("%s", msg) / syslog(LOG_ERR, "%s", msg).
References
Source: packages/engine/rules/sast/c.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.