| Summary: | trunk/timezone/zdump.c:811: missing call to va_end ? | ||
|---|---|---|---|
| Product: | glibc | Reporter: | dcb <dcb314> |
| Component: | time | Assignee: | Not yet assigned to anyone <unassigned> |
| Status: | RESOLVED WORKSFORME | ||
| Severity: | minor | CC: | eggert |
| Priority: | P2 | Flags: | fweimer:
security-
|
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Host: | Target: | ||
| Build: | Last reconfirmed: | 2018-12-12 00:00:00 | |
| Project(s) to access: | ssh public key: | ||
This code is imported from external sources and not modified locally in glibc. Please report your concern to tz@iana.org, not here. Thanks, fixed (but not yet released) upstream as noted here: https://mm.icann.org/pipermail/tz/2018-December/027308.html The fix should be needed only when __STDC_VERSION__ < 199901 or when HAVE_SNPRINTF is defined to be 0, so it's not clear to me whether it's needed for glibc builds. If it is needed, perhaps -DHAVE_SNPRINTF=1 should be added to CFLAGS when compiling tzdb-related files, independently of this bug? In <https://mm.icann.org/pipermail/tz/2018-December/027309.html> dcb reported that this bug was found by a static analysis tool that inspects zdump.c code that should be ifdeffed out for systems like glibc that support C99 or supply snprintf. This issue should therefore not be a bug for glibc (though it is relevant upstream, which still supports C89 <https://mm.icann.org/pipermail/tz/2017-June/025139.html>). Marking the glibc bug as RESOLVED and WORKSFORME, the closest annotation I can see for this situation. |
trunk/timezone/zdump.c:811]: (error) va_list 'args' was opened but not closed by va_end(). Source code is if (n < 0) return n; Suggest new code if (n < 0) { va_end(args); return n; }