Security: The va_list has undefined behavior when passed into functions.

Security: The va_list has undefined behavior when passed into functions.

When the va_list is started using va_start(), the va_arg() must be called within the same function.
This is a design problem with how va_list and its respective functions are implemented.
The man pages directly document that passing an already started va_list to a function and then calling va_arg() is undefined.

The va_list, being a macro, might also be a pointer.
This makes passing it as a pointer (or with "const") risky.

Due to the mentioned undefined states and risks, this is considered and treated as a security issue.

Move the va_XXX() logic into a single function.
This unfortunately means some functions have to be expanded out into the code and deleted.
The code now, unfortunately, has more nested as a result of having to add more loops within the same function.

The va_copy() macro is used and so the ap list state is no longer changed outside of the function.