C++: Disable cpp/implicit-function-declaration on build mode none databases

[geoffw0]

Disable results from cpp/implicit-function-declaration on build mode: none (buildless) databases. This query is very noisy with false positive results on many of these databases, and I believe the cause is fundamental to what BMN is (i.e. not fixable for BMN).

[Copilot]

Pull request overview

Disables cpp/implicit-function-declaration findings on build mode: none (buildless) databases to avoid fundamentally imprecise / noisy results.

Changes:

• Added a build-mode guard to suppress results for cpp/implicit-function-declaration on build mode: none databases.
• Added a change note documenting the analysis behavior change.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md	Documents that the query is now suppressed on build mode: none databases.
cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql	Adds a build-mode check intended to prevent results on build mode: none databases.

[jketema]

I think we need some internal discussion on this. We're now flip-flopping between lowing the accuracy and explicitly disabling the query in BMN (which we did before we lowered the accuracy).

[github-actions]

QHelp previews:

cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp

Implicit function declaration

A function is called without a prior function declaration or definition. When this happens, the compiler generates an implicit declaration of the function, specifying an integer return type and no parameters. If the implicit declaration does not match the true signature of the function, the function may behave unpredictably.

This may indicate a misspelled function name, or that the required header containing the function declaration has not been included.

Note: This query is not compatible with build mode: none databases, and produces no results on those databases.

Recommendation

Provide an explicit declaration of the function before invoking it.

Example

/* '#include <stdlib.h>' was forgotten */

int main(void) {
	/* 'int malloc()' assumed */
	unsigned char *p = malloc(100);
	*p = 'a';
	return 0;
}

References

• SEI CERT C Coding Standard: DCL31-C. Declare identifiers before using them