From f5bd00f153230fbfa77d0153f3dc1d07bf591c38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <daniel.marjamaki@gmail.com>
Date: Sat, 3 Oct 2015 20:51:45 +0200
Subject: [PATCH] Library: return true from Library::isnullargbad() for format
 string arguments. Related with #7012.

---
 lib/library.cpp | 13 +++++++++++++
 lib/library.h   |  6 +-----
 test/cfg/std.c  |  4 ++++
 3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/lib/library.cpp b/lib/library.cpp
index aefc238db..a2da5d187 100644
--- a/lib/library.cpp
+++ b/lib/library.cpp
@@ -683,6 +683,19 @@ static std::string functionName(const Token *ftok)
     return ret;
 }
 
+bool Library::isnullargbad(const Token *ftok, int argnr) const
+{
+    const ArgumentChecks *arg = getarg(ftok, argnr);
+    if (!arg) {
+        // scan format string argument should not be null
+        const std::string funcname = functionName(ftok);
+        std::map<std::string, std::pair<bool, bool> >::const_iterator it = _formatstr.find(funcname);
+        if (it != _formatstr.end() && it->second.first)
+            return true;
+    }
+    return arg && arg->notnull;
+}
+
 bool Library::isuninitargbad(const Token *ftok, int argnr) const
 {
     const ArgumentChecks *arg = getarg(ftok, argnr);
diff --git a/lib/library.h b/lib/library.h
index 325fcd959..07e06f1e9 100644
--- a/lib/library.h
+++ b/lib/library.h
@@ -212,11 +212,7 @@ public:
         return arg && arg->notbool;
     }
 
-    bool isnullargbad(const Token *ftok, int argnr) const {
-        const ArgumentChecks *arg = getarg(ftok, argnr);
-        return arg && arg->notnull;
-    }
-
+    bool isnullargbad(const Token *ftok, int argnr) const;
     bool isuninitargbad(const Token *ftok, int argnr) const;
 
     bool isargformatstr(const Token *ftok, int argnr) const {
diff --git a/test/cfg/std.c b/test/cfg/std.c
index 2e31ed708..b4e02751a 100644
--- a/test/cfg/std.c
+++ b/test/cfg/std.c
@@ -165,6 +165,10 @@ void nullpointer(int value)
     snprintf(NULL, 0, "someformatstring"); // legal
     // cppcheck-suppress nullPointer
     snprintf(NULL, 42, "someformatstring"); // not legal
+
+    scanf("%i", &res);
+    // cppcheck-suppress nullPointer
+    scanf("%i", NULL);
 }
 
 void nullpointerMemchr1(char *p, char *s)