Library: return true from Library::isnullargbad() for format string arguments. Related with #7012.

lib/library.cpp

@@ -683,6 +683,19 @@ static std::string functionName(const Token *ftok)
     return ret;
 }
 
+bool Library::isnullargbad(const Token *ftok, int argnr) const
+{
+    const ArgumentChecks *arg = getarg(ftok, argnr);
+    if (!arg) {
+        // scan format string argument should not be null
+        const std::string funcname = functionName(ftok);
+        std::map<std::string, std::pair<bool, bool> >::const_iterator it = _formatstr.find(funcname);
+        if (it != _formatstr.end() && it->second.first)
+            return true;
+    }
+    return arg && arg->notnull;
+}
+
 bool Library::isuninitargbad(const Token *ftok, int argnr) const
 {
     const ArgumentChecks *arg = getarg(ftok, argnr);

lib/library.h

@@ -212,11 +212,7 @@ public:
         return arg && arg->notbool;
     }
 
-    bool isnullargbad(const Token *ftok, int argnr) const {
+    bool isnullargbad(const Token *ftok, int argnr) const;
-        const ArgumentChecks *arg = getarg(ftok, argnr);
-        return arg && arg->notnull;
-    }
-
     bool isuninitargbad(const Token *ftok, int argnr) const;
 
     bool isargformatstr(const Token *ftok, int argnr) const {

test/cfg/std.c

@@ -165,6 +165,10 @@ void nullpointer(int value)
     snprintf(NULL, 0, "someformatstring"); // legal
     // cppcheck-suppress nullPointer
     snprintf(NULL, 42, "someformatstring"); // not legal
+
+    scanf("%i", &res);
+    // cppcheck-suppress nullPointer
+    scanf("%i", NULL);
 }
 
 void nullpointerMemchr1(char *p, char *s)