*scanf, wrong types in va_arg, and strict aliasing

[Pascal Cuoq <cuoq@trust-in-soft.com>]

Hello again,


the scanf implementation does the same thing as the printf implementation, in vfscanf.c, line 110:

https://git.musl-libc.org/cgit/musl/tree/src/stdio/vfscanf.c?id=54807d47acecab778498ced88ce8f62bfa16e379#n110

This line is eventually reached, for instance, for the snippet:

int n; sscanf("0", "%d", &n);

And the argument being consumed has type int*. This is not a case that 7.16.1.1:2 allows.


Besides, since I am reviewing this file, and since I was originally interested in analyzing it for strict aliasing violations (although the analyzer is not ready to handle this file), I should point out the function store_int at line 22 and the way it is used at line 146:

https://git.musl-libc.org/cgit/musl/tree/src/stdio/vfscanf.c?id=54807d47acecab778498ced88ce8f62bfa16e379#n22

https://git.musl-libc.org/cgit/musl/tree/src/stdio/vfscanf.c?id=54807d47acecab778498ced88ce8f62bfa16e379#n146

This will not go down well with the strict aliasing analyzer, when it is finally ready for this sort of code. And indeed, compiling the previous scanf snippet together with musl's source code while enabling link-time optimization could plausibly produce non-working binary code because of the type-based alias analysis.

For this latter problem, use of types with the may_alias attribute will fix it for GCC and Clang. For the problem with va_arg, I do not see any easy way out. It might be possible to write a longer version that a modern compiler miraculously recognizes as doing the same thing over and over and folds back into a single sequence of instructions, but without having tried it yet, this seems a bit far-fetched.


Pascal