+This query finds calls of scanf-like functions with missing or +improper return-value checking. +
++Specifically, the query flags uses of variables that may have been modified by +scanf and subsequently are used without being guarded by a correct +return-value check. A proper check is one that ensures that the corresponding +scanf has returned (at least) a certain minimum constant. +
++Functions in the scanf family return either EOF (a negative value) +in case of IO failure, or the number of items successfully read from the +input. Consequently, a simple check that the return value is truthy (nonzero) +is not enough. +
++Ensure that all subsequent uses of scanf output arguments occur in a +branch of an if statement (or similar), in which it is known that the +corresponding scanf call has in fact read all possible items from its +input. This can be done by comparing the return value to a numerical constant. +
+This example shows different ways of guarding a scanf output: +
+