C++: Mark the write to fprintf's 0'th argument as partial

[MathiasVP]

This fixes a FN that @jketema noticed on the Coding Standards queries.

The new results in cpp/non-constant-format and cpp/tainted-format-string highlight some really weird code:

#define die(fmt,args...) do { fprintf(stderr, fmt, ## args ); fflush(stderr); exit(-1); } while(0)
...
if(/*NEEDTMP &&*/ !(tmp = (unsigned char*)malloc(ns))) die(stderr, "malloc error\n");

We get new results on stderr. It took me a second to spot the issue, but it looks like die expands to:

do { fprintf(stderr, stderr, "malloc error\n"); fflush(stderr); exit(-1); } 

Which seems very bad! So this looks like TPs 🎉

[Copilot]

Pull Request Overview

This PR improves taint tracking for formatting functions like fprintf by marking writes to their FILE stream parameter as partial writes. This ensures that taint flows through the stream parameter correctly when it's used as both input and output.

• Adds a new test case demonstrating taint flow through fprintf's FILE parameter
• Implements isPartialWrite method in the FormattingFunction class to mark stream outputs as partial
• Updates the SSA implementation to properly handle the partial flow logic

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
FormattingFunction.qll	Implements isPartialWrite to mark stream parameters as partial writes
SsaImpl.qll	Fixes variable reference in modeledFlowBarrier predicate
taint.cpp	Adds test case for taint flow through fprintf FILE parameter
taint.ql	Adds support for indirect_sink in test queries
*.expected	Updated test expectations reflecting the new taint flow behavior

---

_{You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.}

[jketema]

Given where you added this, this presumably also leads more flow on the first argument of functions like sprintf. Is that correct? If so, is that what we want?

[MathiasVP]

The this.getOutputParameterIndex(true) conjunct only holds for formatting functions which specify that the output parameter is a stream, and sprintf implements this predicate with isStream = false. So this shouldn't affect sprintf.

[jketema]

Thanks for the clarification!

[jketema]

LGTM