CWE-1056 flags a named callable or method whose signature accepts a variable number of parameters. It applies to C and C++ varargs, Java varargs, Python *args, and similar features in other languages. It is a design smell more than a bug, and it catches teams that value flexible APIs.
How it happens
A helper starts with two arguments. Someone needs a third, then a fourth, so the signature becomes variadic. Callers can now pass almost anything, and the function body has to guess what it received.
/* Pattern to review: the compiler cannot check argument types */
void log_event(const char *fmt, ...);
/* Clearer: fixed, typed parameters */
void log_event(const char *message, int severity);
What an attacker gains
MITRE lists reduced reliability. If an attacker can reach the code, the reliability problem "might introduce a vulnerability." The record also notes that with variadic arguments, it can be difficult or inefficient for manual analysis to be certain of which function is being called with which arguments.
How to find it
MITRE says automated static analysis (SAST) can find some instances by modeling the source code. A text search for ... in C signatures or *args in Python is a rough first pass.
How to fix it
- Replace variadic signatures with fixed, typed parameters where the set of inputs is known.
- Where the number really varies, accept a typed list or a small options object instead.
- In languages with format strings, keep the format string a constant that the caller cannot influence.
Quick check
Why are variadic functions harder to review?
Reviewers and tools cannot easily tell which arguments reach which call, so mistakes hide more easily.
