The application uses an insecure format string. If formatting arguments come from an untrusted source, an attacker can disrupt the structure of the string or cause a buffer overflow, which leads to application crash or valuable data leak.

String format functions accept any number of arguments and can not determine how many arguments are passed in a particular call. If you pass fewer arguments than the format string provides, the missing data may be taken from the stack, which, in general, contains the data not related to the current call.

Format string vulnerabilities are characteristic of C language. All C constructions are correct in Objective-C, so applications in Objective-C are also vulnerable when using C API.

C or C++ : Variable self-assignment

DerScanner Severity Score

Do you want to fix C or C++ : Variable self-assignment in your application?

See also