---
name: "fmtcheck"
section: "3"
platform: "macos"
package: "Libc"
version: "1752.120.2"
release: "macOS 26.5"
platforms: ["linux", "freebsd", "macos"]
url: "https://new.carta.tech/fmtcheck"
---

# fmtcheck(3)

sanitizes user-supplied printf(3)-style format string

## NAME

**fmtcheck** – sanitizes user-supplied [printf(3)](/printf/3.md)-style format string

## LIBRARY

Standard C Library (libc, -lc)

## SYNOPSIS

**#include \<stdio.h\>**

*const* *char* *\**\

**fmtcheck**(*const char \*fmt\_suspect*, *const char \*fmt\_default*);

## DESCRIPTION

The **fmtcheck**() scans *fmt\_suspect* and *fmt\_default* to determine if *fmt\_suspect* will consume the same argument types as *fmt\_default* and to ensure that *fmt\_suspect* is a valid format string.

The [printf(3)](/printf/3.md) family of functions cannot verify the types of arguments that they are passed at run-time. In some cases, like [catgets(3)](/catgets/3.md), it is useful or necessary to use a user-supplied format string with no guarantee that the format string matches the specified arguments.

The **fmtcheck**() was designed to be used in these cases, as in:

```
printf(fmtcheck(user_format, standard_format), arg1, arg2);
```

In the check, field widths, fillers, precisions, etc. are ignored (unless the field width or precision is an asterisk ‘\*’ instead of a digit string). Also, any text other than the format specifiers is completely ignored.

## RETURN VALUES

If *fmt\_suspect* is a valid format and consumes the same argument types as *fmt\_default*, then the **fmtcheck**() will return *fmt\_suspect*. Otherwise, it will return *fmt\_default*.

## SECURITY CONSIDERATIONS

Note that the formats may be quite different as long as they accept the same arguments. For example, "%p %o %30s %#llx %-10.\*e %n" is compatible with "This number %lu %d%% and string %s has %qd numbers and %.\*g floats (%n)". However, "%o" is not equivalent to "%lx" because the first requires an integer and the second requires a long.

## SEE ALSO

[printf(3)](/printf/3.md)

## BUGS

The **fmtcheck**() function does not recognize positional parameters.