[Bug analyzer/126858] New: -Wanalyzer-use-of-uninitialized-value false positive with printf's %n

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126858

            Bug ID: 126858
           Summary: -Wanalyzer-use-of-uninitialized-value false positive
                    with printf's %n
           Product: gcc
           Version: 17.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: vincent-gcc at vinc17 dot net
  Target Milestone: ---

Consider:

#include <stdio.h>
int main (void)
{
  int n;
  printf ("%n", &n);
  return n != 0;
}

With gcc (Debian 20260725-1) 17.0.0 20260725 (experimental) [trunk
r17-2699-gf6b00aefc25], -fanalyzer gives:

tst.c: In function 'main':
tst.c:6:12: warning: use of uninitialized value 'n' [CWE-457]
[-Wanalyzer-use-of-uninitialized-value]
    6 |   return n != 0;
      |          ~~^~~~
  'main': events 1-3
    4 |   int n;
      |       ^
      |       |
      |       (1) region created on stack here
      |       (2) capacity: 4 bytes
    5 |   printf ("%n", &n);
    6 |   return n != 0;
      |          ~~~~~~
      |            |
      |            (3) ⚠  use of uninitialized value 'n' here

while the purpose of "%n" with &n is to store the number of characters written
so far (i.e. 0) into the variable n. So n is necessarily initialized to 0
there.