CPP: Fix FPs.

cpp/ql/src/semmle/code/cpp/commons/Printf.qll

@@ -169,7 +169,12 @@ class FormattingFunctionCall extends Expr {
    * Gets the number of arguments to this call that are parameters to the
    * format string.
    */
-  int getNumFormatArgument() { result = count(this.getFormatArgument(_)) }
+  int getNumFormatArgument() {
+  	result = count(this.getFormatArgument(_)) and
+
+  	// format arguments must be known
+  	exists(getTarget().(FormattingFunction).getFirstFormatArgumentIndex())
+ }
 }
 
 /**

cpp/ql/src/semmle/code/cpp/models/interfaces/FormattingFunction.qll

@@ -115,7 +115,20 @@ abstract class FormattingFunction extends Function {
    * Gets the position of the first format argument, corresponding with
    * the first format specifier in the format string.
    */
-  int getFirstFormatArgumentIndex() { result = getNumberOfParameters() }
+  int getFirstFormatArgumentIndex() {
+  	result = getNumberOfParameters()
+  	and
+    // the formatting function either has a definition in the snapshot, or all
+    // `DeclarationEntry`s agree on the number of parameters (otherwise we don't
+    // really know the correct number)
+    (
+      hasDefinition() or
+      forall(FunctionDeclarationEntry fde |
+        fde = getADeclarationEntry() |
+        result = fde.getNumberOfParameters()
+      )
+    )
+  }
 
   /**
    * Gets the position of the buffer size argument, if any.