openssh bugs - Oct 2023 - [Bug 3624] New: potentially uninitialized local pointers in assemble_algorithms() in servconf.c

https://bugzilla.mindrot.org/show_bug.cgi?id=3624

            Bug ID: 3624
           Summary: potentially uninitialized local pointers in
                    assemble_algorithms() in servconf.c
           Product: Portable OpenSSH
           Version: 9.5p1
          Hardware: All
                OS: All
            Status: NEW
          Severity: trivial
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: tessgauthier at microsoft.com

Overview:

*def_cipher, *def_mac, *def_kex, *def_key, *def_sig are uninitialized
pointers.

static void
assemble_algorithms(ServerOptions *o)
{
        char *all_cipher, *all_mac, *all_kex, *all_key, *all_sig;
        char *def_cipher, *def_mac, *def_kex, *def_key, *def_sig;
        int r;
...
}

Expected:
char *def_cipher = NULL, *def_mac = NULL, *def_kex = NULL, *def_key NULL,
*def_sig = NULL;

Additional Information:
Corresponding compiler warning -
https://learn.microsoft.com/en-us/cpp/error-messages/compiler-warnings/compiler-warning-level-4-c4703?view=msvc-170&f1url=%3FappId%3DDev16IDEF1%26l%3DEN-US%26k%3Dk(C4703)%26rd%3Dtrue

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3624

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |INVALID
                 CC|                            |djm at mindrot.org

--- Comment #1 from Damien Miller <djm at mindrot.org> ---
This is definitely a bogus warning. The pointers in question are
initialised in the lines immediately following declaration:

https://github.com/openssh/openssh-portable/blob/V_9_5_P1/servconf.c#L212-L226

Please spend a moment to validate compiler warnings before posting them
as bugs here.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.