VNX-1056: Invokable Control Element with Variadic Parameters

Reports a C or C++ printf-style variadic function definition (a format string followed by ..., forwarded to the v*printf or v*scanf family) that has no format attribute on its definition or any prototype, so the compiler cannot check its arguments. Prototypes, macros, function pointers, variadic templates, count- or sentinel-driven variadics and attributed wrappers are not reported.

Field	Value
Rule ID	`VNX-1056`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-1056
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`variadic-params` `format-string` `cwe-1056`
Source	`internal/sast/rules/vnx-1056.rego`

Overview

VNX-1056 maps to CWE-1056: Invokable Control Element with Variadic Parameters. It reports a C or C++ function definition with a C-style variadic parameter list whose last named parameter is a format string (a char pointer named fmt, format, msg or message) and whose body forwards the va_list to the printf family (vfprintf, vsnprintf, vsyslog, …), when neither the definition nor any prototype of the function in the scanned sources carries a printf-style format attribute (__attribute__((format(printf, n, m))), __printflike, G_GNUC_PRINTF and similar macros).

Why This Matters

The arguments after ... are not type-checked. Without a format attribute the compiler cannot match them to the format string, so a missing, extra or wrongly typed argument is undefined behaviour that reads the stack, and a caller passing an attacker-controlled string as the format goes unnoticed (CWE-134).

Not reported: prototypes, macros (#define TRACE(fmt, ...)), function pointers, C++ variadic templates (typename... Args, which are type-checked), variadic functions whose last named parameter is a count or a sentinel-terminated pointer, wrappers with a custom (non-printf) format, wrappers attributed in a header, and comments.

What Gets Flagged

void log_event(int level, const char *fmt, ...) {
    va_list ap;
    va_start(ap, fmt);
    vfprintf(stderr, fmt, ap);
    va_end(ap);
}

Not flagged:

int buf_printf(struct buf *b, const char *fmt, ...)
    __attribute__((format(printf, 2, 3)));

Remediation

Add __attribute__((format(printf, n, m))) (or the project’s portable macro) to the prototype, where n is the format parameter’s position and m the position of ....
In C++, prefer a variadic template or std::format, which check argument types at compile time.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1056
// nosec vnx-1056

Or record an ignore rule: vulnetix ignore add --rule vnx-1056 --reason "...". See Suppressing findings.