C++: Handle builtin FormattingFunctions better

github · Oct 23, 2024 · f37be68 · f37be68
1 parent c5a082f
commit f37be68
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/FormattingFunction.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/FormattingFunction.qll
@@ -49,9 +49,12 @@ abstract class FormattingFunction extends ArrayFunction, TaintFunction {
     if this.hasDefinition()
     then firstFormatArgumentIndex = this.getDefinition().getNumberOfParameters()
     else
-      forex(FunctionDeclarationEntry fde | fde = this.getAnExplicitDeclarationEntry() |
-        firstFormatArgumentIndex = fde.getNumberOfParameters()
-      )
+      if this instanceof BuiltInFunction
+      then firstFormatArgumentIndex = this.getNumberOfParameters()
+      else
+        forex(FunctionDeclarationEntry fde | fde = this.getAnExplicitDeclarationEntry() |
+          firstFormatArgumentIndex = fde.getNumberOfParameters()
+        )
   }
 
   /** Gets the position at which the format parameter occurs. */