Due to a typo, sprintf() was recognized as a taint source instead of a
taint propagator. It was because an empty taint source list - which is
the first parameter of the TaintPropagationRule - encoded the
unconditional taint sources.
This typo effectively turned the sprintf() into an unconditional taint
This patch fixes that typo and demonstrated the correct behavior with