flawfinder mischaracterizes printf -> vprintf style about flawfinder HOT 3 OPEN

Flawfinder is a lexing-only tool, so I don't see how we can handle this case.

To do more requires actually reading the code into some sort of data structure, which is obviously possible but not how flawfinder works.

from flawfinder.

Perhaps such suggestion should not be emitted? If the diagnostic message is associated with vfprintf will it ever be correct to pass ap but take literal string as fmt? I think the suggestion is over-applied from printf or fprintf but no longer applies in vfprintf.

from flawfinder.

Oh, it definitely applies. If the fmt is from an attacker, the attacker could use %n to write to arbitrary memory, or reveal data that's not supposed to be revealed. If that's less likely we could reduce its risk level to say 3 instead of 4. Unfortunately, a lexically-based tool like flawfinder has no way to determine if the fmt is controlled by an attacker or not; that would require interprocedural flow control, and even then it's often impossible to tell (you also need to know which inputs are trusted, which is typically not information you can derive just from the source code).

from flawfinder.