[Bug analyzer/126859] New: -Wanalyzer-use-of-uninitialized-value false positive with function with a variable number of arguments and pointer argument

[vincent-gcc at vinc17 dot net via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126859

            Bug ID: 126859
           Summary: -Wanalyzer-use-of-uninitialized-value false positive
                    with function with a variable number of arguments and
                    pointer argument
           Product: gcc
           Version: 17.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: vincent-gcc at vinc17 dot net
  Target Milestone: ---

Consider:

#include <stdarg.h>

void h (int, va_list);

static void t (int i, ...)
{
  va_list ap;
  va_start (ap, i);
  h (i, ap);
  va_end (ap);
}

int f1 (void)
{
  int n;
  t (0, &n);
  return n;
}

int f2 (void)
{
  int n;
  t (0, 0, &n);
  return n;
}

int f3 (void)
{
  int n;
  t (0, 0, 0, &n);
  return n;
}

With gcc (Debian 20260725-1) 17.0.0 20260725 (experimental) [trunk
r17-2699-gf6b00aefc25], "gcc -fanalyzer -c tst.c" gives the following warning
on f2 and f3 only, though they look very similar to f1:

warning: use of uninitialized value 'n' [CWE-457]
[-Wanalyzer-use-of-uninitialized-value]

Note that if I replace the declarations of functions h and t with just

void t (int i, ...);

then I no longer get any warning (which makes me think that this is different
from PR126858).

The above testcase is close to what the tfprintf.c test of the GNU MPFR
testsuite has, from which I found this bug.