Warning C6064

Missing integer argument to 'function-name' corresponding to conversion specifier 'number'

Remarks

This warning indicates that the code doesn't provide enough arguments to match a format string and one of the missing arguments is an integer.

Providing too few arguments to a format function leads to undefined behavior because the function attempts to read values that aren't passed. Possible consequences include incorrect output, crashes, or even security vulnerabilities such as information leaks.

To ensure stability and safety, always match the number and types of arguments to the format specifiers in the string.

Code analysis name: MISSING_INTEGER_ARGUMENT_TO_FORMAT_FUNCTION

Example

The following code generates this warning by passing the wrong number of arguments to sprintf_s and the missing argument is an integer. If the unsafe function sprintf was used instead of the safer variant sprintf_s, this code would likely cause a stack overflow instead of just unexpected output:

void f()
{
    char buff[8];
    const char *string="Hello";
    sprintf_s(buff, sizeof(buff), "%s %d", string);  // Attempts to print "Hello "
    // followed by a number up to eleven characters long, depending on the garbage
    // found on the stack. Any number other than a single non-negative digit can't
    // fit in the 8 char buffer and leave room for the trailing null. If sprintf 
    // had been used instead, it would overflow.
}

To correct this warning, specify the missing arguments or adjust the format string. In this example, we add the missing integer value.

void f()
{
    char buff[8];
    const char *string = "Hello";
    sprintf_s(buff, sizeof(buff), "%s %d", string, strlen(string));
}

See also

sprintf_s, _sprintf_s_l, swprintf_s, _swprintf_s_l
C4473