Question

So I ran some static code analyzer over some c code and one thing that surprised me was a warning about:

int val;
scanf("%d", &val);

which said that for large enough input this may result in a segfault. And surely enough this can actually happen. Now the fix is simple enough (specify some width; after all we know how many places a valid integer may have at most depending on the architecture) but what I’m wondering about is WHY this is happening in the first place and why this isn’t regarded as a bug in libc (and a simple one to fix at that)?

Now I assume there’s some reason for this behavior in the first place that I’m missing?

Edit: Ok since the question doesn’t seem to be such clear cut, a bit more explanation:
No the code analyzer doesn’t warn about scanf in general but about scanf reading a digit without a width specified in specific.

So here’s a minimal working example:

#include <stdlib.h>
#include <stdio.h>

int main() {
    int val;
    scanf("%d", &val);
    printf("Number not large enough.\n");
    return 0;
}

We can get a segfault by sending a gigantic number (using eg Python):

import subprocess
cmd = "./test"
p = subprocess.Popen(cmd, stdin=subprocess.PIPE, shell=True)
p.communicate("9"*50000000000000)
# program will segfault, if not make number larger

Answer 1

If the static analyzer is cppcheck, then it is warning about it because of a bug in glibc which has since been fixed: http://sources.redhat.com/bugzilla/show_bug.cgi?id=13138