Function takes a variable argument list
ID |
c.maintainability.avoid_variadic_functions |
Severity |
low |
Remediation Complexity |
hard |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Api Design |
Language |
C / C++ |
Description
This function takes a variable argument list. The compiler cannot check the number or the types of what callers pass, so a mismatch becomes undefined behaviour at run time rather than a build error. Prefer an overload set, a struct parameter, or a variadic template in C++, all of which keep the type checking.
Rationale
This function takes a variable argument list. The compiler cannot check the number or the types of what callers pass, so a mismatch becomes undefined behaviour at run time rather than a build error. Prefer an overload set, a struct parameter, or a variadic template in C++, all of which keep the type checking.
The following code illustrates the pattern detected by this rule:
int sum_all(int count, ...)
{
va_list args;
// FLAGGED: Function takes a variable argument list
va_start(args, count);
int total = 0;
for (int i = 0; i < count; i++) {
total += va_arg(args, int);
}
va_end(args);
return total;
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.