From ff48ac5434e334cb724295e626d4c998c4043fc1 Mon Sep 17 00:00:00 2001 From: MarkLee131 Date: Tue, 17 Mar 2026 22:45:38 +0800 Subject: [PATCH] C++: exclude printf implementation internals from format string sinks --- .../CWE/CWE-134/UncontrolledFormatString.ql | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql index 37e3fa0c49f8..4c0271ef96e7 100644 --- a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql +++ b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql @@ -23,13 +23,32 @@ import Flow::PathGraph predicate isSource(FlowSource source, string sourceType) { sourceType = source.getSourceType() } +/** + * Holds if `f` is a printf-like function or a (possibly nested) wrapper + * that forwards a format-string parameter to one. + * + * Functions that *implement* printf-like behaviour (e.g. a custom + * `vsnprintf` variant) internally parse the caller-supplied format string + * and build small, bounded, local format strings such as `"%d"` or `"%ld"` + * for inner `sprintf` calls. Taint that reaches those inner calls via the + * parsed format specifier is not exploitable, so sinks inside such + * functions should be excluded. + */ +private predicate isPrintfImplementation(Function f) { + f instanceof PrintfLikeFunction + or + exists(PrintfLikeFunction printf | printf.wrapperFunction(f, _, _)) +} + module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node node) { isSource(node, _) } predicate isSink(DataFlow::Node node) { exists(PrintfLikeFunction printf | printf.outermostWrapperFunctionCall([node.asExpr(), node.asIndirectExpr()], _) - ) + ) and + not isPrintfImplementation(node.asExpr().getEnclosingFunction()) and + not isPrintfImplementation(node.asIndirectExpr().getEnclosingFunction()) } private predicate isArithmeticNonCharType(ArithmeticType type) {