---
name: "pscan"
section: "1"
platform: "linux"
package: "pscan"
version: "1.3-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/pscan"
---

# pscan(1)

Format string security checker for C source code

## NAME

pscan - Format string security checker for C source code

## SYNOPSIS

**pscan** \[*options*\]

## DESCRIPTION

**pscan** is a source code analysis tool which is designed to highlight potentially dangerous uses of variadic functions such as "printf", "syslog", etc. The scan works by looking for a one of a list of problem functions, and applying the following rule:

IF the last parameter of the function is the format string, AND the format string is NOT a static string, THEN complain.

## LIMITATIONS

The code will not report on some potention buffer overflows, because that is not its goal. For example the following code is potential dangerous:

  **sprintf(static\_buffer,  %s/.foorc", getenv("HOME"));"**

This code could cause an issue as there is no immediately obvious bounds checking. However this is a safe usages with regards to format strings.

## RETURN VALUES

If there are any errors found, **pscan** exits with status 1.

## AUTHOR

Alan DeKok \<aland@ox.org\>