bug#70944: uninitialized variable used in libtoolize, function func_serial_update

Hi,

I'm building libtool from the git repository, as follows:

rm -f .gitmodules
date --utc --iso-8601 > .tarball-version
./bootstrap --no-git --gnulib-srcdir="$GNULIB_SRCDIR"
./configure --config-cache CPPFLAGS="-Wall"
make
make check TESTSUITEFLAGS="--debug"

and I see a failure of test 13:

 13: upgrading verbatim style aclocal.m4             FAILED (libtoolize.at:691)

testsuite.dir/013/testsuite.log contains this diff:

--- expout	2024-05-14 11:34:43.166241683 +0000
+++ /home/runner/work/ci-check/ci-check/libtool/tests/testsuite.dir/at-groups/13/stdout	2024-05-14 11:34:43.326241473 +0000
@@ -1,5 +1,6 @@
 libtoolize: putting macros in AC_CONFIG_MACRO_DIRS, 'm4'.
 libtoolize: copying file 'm4/libtool.m4'
+libtoolize: You should add the contents of 'm4/libtool.m4' to 'aclocal.m4'.
 libtoolize: copying file 'm4/ltoptions.m4'
 libtoolize: copying file 'm4/ltsugar.m4'
 libtoolize: You should add the contents of 'm4/ltsugar.m4' to 'aclocal.m4'.
13. libtoolize.at:624: 13. upgrading verbatim style aclocal.m4 (libtoolize.at:624): FAILED (libtoolize.at:691)

Why is this line "You should add the contents of 'm4/libtool.m4' to 'aclocal.m4'."
printed?

It's because in function func_serial_update, the value of my_src_serial is
used, which has not been set in this function, but in a completely different
function.

Namely, first, func_serial_update_check is called, which performs the
assignments

  my_srcfile=/LIBTOOL/libtool/build-aux/ltmain.sh
  my_src_serial=2024

based on a sed script that extracts the package_revision of build-aux/ltmain.sh,
which in my case has in line 5:

  # libtool (GNU libtool) 2024-05-14

Then, later, in function func_serial_update, my_src_serial still has the old
value. The parameters of this invocation are:

  my_filename=libtool.m4
  my_srcdir=/LIBTOOL/libtool/m4
  my_destdir=m4
  my_msg_var=my_pkgmacro_header
  my_macro_regex=LT_INIT
  my_old_macro_regex='A[CM]_PROG_LIBTOOL'
  my_serial_update_p=:

  my_srcfile=/LIBTOOL/libtool/m4/libtool.m4
  my_destfile=m4/libtool.m4

The block

  if test -f "$my_destfile"; then
    ...
  fi

is skipped, because $my_destfile does not yet exist. Then

  my_included_files=aclocal.m4

and

  func_serial_max 2024 25

Thus it uses the "serial version" 2024 of ltmain.sh and compares it to
the serial version 25 of aclocal.m4.

This is obviously buggy. It makes no sense to compare the serial number
of two unrelated files (ltmain.sh and aclocal.m4).

The attached patch fixes it for me.

From 2e2db9731d22917135bdf86519094e24c3145562 Mon Sep 17 00:00:00 2001
From: Bruno Haible <[email protected]>
Date: Tue, 14 May 2024 17:37:20 +0200
Subject: [PATCH] libtoolize: Don't use uninitialized variable.

* libtoolize.in (func_serial_update): Initialize my_src_serial and
my_dest_serial before use.
* tests/libtoolize.at: Update expected test result.
---
 libtoolize.in       | 4 +++-
 tests/libtoolize.at | 3 ---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/libtoolize.in b/libtoolize.in
index 336fc81b..23741aaf 100644
--- a/libtoolize.in
+++ b/libtoolize.in
@@ -657,6 +657,8 @@ func_serial_update ()
 
     test -f "$my_srcfile" || func_fatal_error "'$my_srcfile' does not exist."
 
+    my_src_serial=
+    my_dest_serial=
     if test -f "$my_destfile"; then
       my_src_serial=`func_serial "$my_srcfile" "$my_macro_regex"`
       my_dest_serial=`func_serial "$my_destfile" "$my_macro_regex"`
@@ -696,7 +698,7 @@ func_serial_update ()
       # serial tags, so the update message will be correctly given
       # if aclocal.m4 contains an untagged --i.e older-- macro file):
       *)
-        if test -f aclocal.m4; then
+        if test -f aclocal.m4 && test "X$my_src_serial" != X; then
           func_serial_max \
               "$my_src_serial" `func_serial aclocal.m4 "$my_macro_regex"`
           if test "X$my_src_serial" = "X$func_serial_max_result"; then
diff --git a/tests/libtoolize.at b/tests/libtoolize.at
index cbc21d68..a9ed75a6 100644
--- a/tests/libtoolize.at
+++ b/tests/libtoolize.at
@@ -681,11 +681,8 @@ AT_DATA([expout],
 libtoolize: copying file 'm4/libtool.m4'
 libtoolize: copying file 'm4/ltoptions.m4'
 libtoolize: copying file 'm4/ltsugar.m4'
-libtoolize: You should add the contents of 'm4/ltsugar.m4' to 'aclocal.m4'.
 libtoolize: copying file 'm4/ltversion.m4'
-libtoolize: You should add the contents of 'm4/ltversion.m4' to 'aclocal.m4'.
 libtoolize: copying file 'm4/lt~obsolete.m4'
-libtoolize: You should add the contents of 'm4/lt~obsolete.m4' to 'aclocal.m4'.
 ]])
 
 LT_AT_CHECK_LIBTOOLIZE([--copy], 0, expout)
-- 
2.34.1