<!DOCTYPE qhelp PUBLIC
  "-//Semmle//qhelp//EN"
  "qhelp.dtd">
<qhelp>


<overview>
<p>A function is called with fewer arguments than there are parameters of the function.</p>

<p>This may indicate that an incorrect function is being called, or that the signature
 (parameter list) of the called function is not known to the author.</p>

<p>In C, function calls generally need to provide the same number of arguments as there are
 arguments to the function. (Variadic functions can accept additional arguments.)  Providing
 fewer arguments than there are parameters is extremely dangerous, as the called function
 will nevertheless try to obtain the missing arguments' values, either from the stack
 or from machine registers.  As a result, the function may behave unpredictably.</p>
 
<p>If the called function <i>modifies</i> a parameter corresponding to a missing argument, it
 may alter the state of the program upon its return.  An attacker could use this to,
 for example, alter the control flow of the program to access forbidden resources.</p>

</overview>
<recommendation>
<p>Call the function with the correct number of arguments.</p>

</recommendation>
<example><sample src="TooFewArguments.c" />

</example>

<references>
<li>SEI CERT C Coding Standard: <a href="https://wiki.sei.cmu.edu/confluence/display/c/DCL20-C.+Explicitly+specify+void+when+a+function+accepts+no+arguments"> DCL20-C. Explicitly specify void when a function accepts no arguments </a></li>
</references>
</qhelp>
