From 775eaeb420578cbac18eae2f4dbf2b94f3183fbc Mon Sep 17 00:00:00 2001
From: Donat Zenichev <dzenichev@sipwise.com>
Date: Fri, 11 Apr 2025 08:10:37 +0200
Subject: [PATCH] MT#59962 XmlRpcValue: initialize `tm`

Fixes:

*** CID 549010:  Uninitialized variables  (UNINIT)
/apps/xmlrpc2di/xmlrpc++/src/XmlRpcValue.cpp: 395 in
            XmlRpc::XmlRpcValue::timeFromXml(const std::__cxx11::basic_string<char,
            std::char_traits<char>, std::allocator<char>> &, unsigned long *)()
389         if (sscanf(stime.c_str(),"%4d%2d%2dT%2d:%2d:%2d",&t.tm_year,&t.tm_mon,
                &t.tm_mday,&t.tm_hour,&t.tm_min,&t.tm_sec) != 6)
390           return false;
391
392         t.tm_year -= 1900;
393         t.tm_isdst = -1;
394         _type = TypeDateTime;
>>>     CID 549010:  Uninitialized variables  (UNINIT)
>>>     Using uninitialized value "t". Field "t.tm_wday" is uninitialized.
395         _value.asTime = new struct tm(t);
396         *offset += stime.length();
397         return true;
398       }
399
400       std::string XmlRpcValue::timeToXml() const

Change-Id: Ifbefcf8e79d7113e1fdc8c92dfc5c39d480a882d
---
 apps/xmlrpc2di/xmlrpc++/src/XmlRpcValue.cpp | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/apps/xmlrpc2di/xmlrpc++/src/XmlRpcValue.cpp b/apps/xmlrpc2di/xmlrpc++/src/XmlRpcValue.cpp
index b1858def..5dcef890 100644
--- a/apps/xmlrpc2di/xmlrpc++/src/XmlRpcValue.cpp
+++ b/apps/xmlrpc2di/xmlrpc++/src/XmlRpcValue.cpp
@@ -385,12 +385,15 @@ namespace XmlRpc {
 
     std::string stime = valueXml.substr(*offset, valueEnd-*offset);
 
-    struct tm t;
+    /* zero-initialize */
+    struct tm t = {};
     if (sscanf(stime.c_str(),"%4d%2d%2dT%2d:%2d:%2d",&t.tm_year,&t.tm_mon,&t.tm_mday,&t.tm_hour,&t.tm_min,&t.tm_sec) != 6)
       return false;
 
     t.tm_year -= 1900;
     t.tm_isdst = -1;
+    t.tm_mon--; /* sscanf reads months as 1-12, but tm_mon expects 0-11. So not adjusting it can lead to an incorrect date. */
+
     _type = TypeDateTime;
     _value.asTime = new struct tm(t);
     *offset += stime.length();
@@ -403,7 +406,7 @@ namespace XmlRpc {
     char buf[18];
 
     if (snprintf(buf, sizeof(buf), "%04d%02d%02dT%02d:%02d:%02d",
-                (1900 + t->tm_year), t->tm_mon, t->tm_mday, t->tm_hour, t->tm_min, t->tm_sec) < 0)
+                (1900 + t->tm_year), (1 + t->tm_mon), t->tm_mday, t->tm_hour, t->tm_min, t->tm_sec) < 0)
     {
       XmlRpcUtil::log(2,"timeToXml: issues while trying to write data.");
     }
@@ -557,7 +560,7 @@ namespace XmlRpc {
           struct tm* t = _value.asTime;
           char buf[20];
           snprintf(buf, sizeof(buf)-1, "%4d%02d%02dT%02d:%02d:%02d", 
-            t->tm_year,t->tm_mon,t->tm_mday,t->tm_hour,t->tm_min,t->tm_sec);
+            (1900 + t->tm_year), (1 + t->tm_mon),t->tm_mday,t->tm_hour,t->tm_min,t->tm_sec);
           buf[sizeof(buf)-1] = 0;
           os << buf;
           break;