From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=P/l5=GX=nifty.ne.jp=takashi.yano@sourceware.org>
Received: from dmta1009.nifty.com (mta-snd01001.nifty.com [106.153.227.33])
	by sourceware.org (Postfix) with ESMTPS id 2DE7B3858D37
	for <newlib@sourceware.org>; Fri, 10 Nov 2023 15:55:16 +0000 (GMT)
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 2DE7B3858D37
Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=nifty.ne.jp
Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=nifty.ne.jp
ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 2DE7B3858D37
Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=106.153.227.33
ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1699631720; cv=none;
	b=yBpOfUf1Q82Or2SUVX/BBQ/WkODHWrwS2F0+f/ui7kC/Uxspv+R65eeU/VSGDFC2rWP8ufsXgyNSWz1wwQmrOOXV58U3LGgo+WoDob6cibf9cI2gQN3I90jZ69Mr6n5v0ASJETGdrMYInCNkbbKlcUBZyiX6HpTbnIhNjrzsd58=
ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key;
	t=1699631720; c=relaxed/simple;
	bh=OU66HiM6+EY/NaQgg0F/SThBZlTj13crmNiOFxIyfi8=;
	h=Date:From:To:Subject:Message-Id:Mime-Version; b=IWHYLAzn9f6SP6QMwfOijOZpwD81yz5yyUnKN5tjfBVH4rGI1Jr/CnkVKVUh2Zuw5ousrwn6SgCPcm1YvgKGso17wbD1DlqwFwTe8GROH7yHhyFObIstzqYjfKUkU/WGUW6R1P3qS2e91lsU3i9t12ST0EJOcJGE28jJgW1eHeM=
ARC-Authentication-Results: i=1; server2.sourceware.org
Received: from HP-Z230 by dmta1009.nifty.com with ESMTP
          id <20231110155514665.TEZI.65055.HP-Z230@nifty.com>
          for <newlib@sourceware.org>; Sat, 11 Nov 2023 00:55:14 +0900
Date: Sat, 11 Nov 2023 00:55:15 +0900
From: Takashi Yano <takashi.yano@nifty.ne.jp>
To: newlib@sourceware.org
Subject: Re: Coverity Scan: Analysis completed for RTEMS-Newlib
Message-Id: <20231111005515.6e77d27ca9a5dfa3946fde28@nifty.ne.jp>
In-Reply-To: <ZU5M4PUCpTBiQIhY@calimero.vinschen.de>
References: <654dcb688da84_69bd52d4ed1e699a037313@prd-scan-dashboard-0.mail>
	<CAF9ehCWYLfa8RKNLN=HZZFbifH4gpoTOs1ycsiBGOfN58jpReg@mail.gmail.com>
	<ZU5M4PUCpTBiQIhY@calimero.vinschen.de>
X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.30; i686-pc-mingw32)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-Spam-Status: No, score=-5.1 required=5.0 tests=BAYES_00,KAM_DMARC_STATUS,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,SPF_HELO_PASS,SPF_PASS,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org
List-Id: <newlib.sourceware.org>

On Fri, 10 Nov 2023 16:31:44 +0100
Corinna Vinschen wrote:
> On Nov 10 08:50, Joel Sherrill wrote:
> > Hmmmm.. an email just before the one I forwarded shows 6 new defects were
> > added in the last commits. They appear to be the same issue I just
> > forwarded but in different scanf variants.
> > 
> > CID 423229 (#1 of 1): Uninitialized scalar variable (UNINIT)2.
> > uninit_use_in_call: Using uninitialized value f._flags2 when calling
> > __ssvfiscanf_r. [show details
> > <https://scan3.scan.coverity.com/eventId=13202494-1&modelId=13202494-0&fileInstanceId=104130545&filePath=%2Fhome%2Fjoel%2Frtems-cron-coverity%2Fsourceware-mirror-newlib-cygwin%2Fnewlib%2Flibc%2Fstdio%2Fvfscanf.c&fileStart=400&fileEnd=1980>
> > ]
> 
> Looks like a false positive.
> 
> The ORIENT macro will set or reset the value of the _flags2 __SWID bit
> if the _flags __SORD bit isn't set.  It never is set at the start, so
> the _flags2 __SWID bit is always set.  And only then, the ORIENT macro
> will check the value.

Perhaps, this happens because other bits of _flags2 than __SWID is not
initialized.

Which is better solution do you think?
(1) Modify ORIENT macro so that it returns (ori > 0) ? 1 : -1.
(2) Initialize f._flags2 = 0 in sscanf() family.

-- 
Takashi Yano <takashi.yano@nifty.ne.jp>