In variadic functions we still do the cast. In POSIX, it's not necessary, since NULL is required to be of type 'void *', and 'void *' is guaranteed to have the same alignment and representation as 'char *'. However, since ISO C still doesn't mandate that, and moreover they're doing dubious stuff by adding nullptr, let's be on the cautious side. Also, C++ requires that NULL is not 'void *', but either plain 0 or some magic stuff. Reference: https://github.com/shadow-maint/shadow/pull/642 https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/
Created shadow-utils tracking bugs for this issue: Affects: fedora-36 [bug 2166547] Affects: fedora-37 [bug 2166548]
CVE-2023-0634 rejected now removing from flaw