diff --git a/cfg/std.cfg b/cfg/std.cfg
index a14b07c76..d5bcec0f2 100644
--- a/cfg/std.cfg
+++ b/cfg/std.cfg
@@ -64,7 +64,7 @@
     <returnValue type="intmax_t">arg1&gt;0?arg1:-arg1</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -109,7 +109,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>-1.0:1.0</valid>
     </arg>
@@ -121,7 +121,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>-1.0:1.0</valid>
     </arg>
@@ -133,7 +133,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>-1.0:1.0</valid>
     </arg>
@@ -145,7 +145,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -156,7 +156,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -167,7 +167,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -177,7 +177,7 @@
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
@@ -188,15 +188,15 @@
     <noreturn>false</noreturn>
     <returnValue type="errno_t"/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
       <minsize type="argvalue" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>26:</valid>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-null/>
       <not-uninit/>
       <not-bool/>
@@ -218,7 +218,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0.0:</valid>
     </arg>
@@ -230,7 +230,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0.0:</valid>
     </arg>
@@ -242,7 +242,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0.0:</valid>
     </arg>
@@ -266,7 +266,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -277,7 +277,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -288,7 +288,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -299,7 +299,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -310,7 +310,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -321,7 +321,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -333,7 +333,7 @@
     <pure/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -356,7 +356,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <valid>-1.0:1.0</valid>
       <not-uninit/>
     </arg>
@@ -368,7 +368,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <valid>-1.0:1.0</valid>
       <not-uninit/>
     </arg>
@@ -380,7 +380,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <valid>-1.0:1.0</valid>
       <not-uninit/>
     </arg>
@@ -404,7 +404,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -415,7 +415,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -426,7 +426,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -438,7 +438,7 @@
     <pure/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -454,12 +454,12 @@
     <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-null/>
       <not-uninit/>
       <valid>0:</valid>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
@@ -471,7 +471,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -482,7 +482,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -493,7 +493,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -505,7 +505,7 @@
     <pure/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -516,7 +516,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -527,7 +527,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -538,7 +538,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -550,7 +550,7 @@
     <pure/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -560,7 +560,7 @@
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -569,7 +569,7 @@
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
     </arg>
   </function>
@@ -616,7 +616,7 @@
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
@@ -669,7 +669,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -680,7 +680,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -691,7 +691,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -747,7 +747,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -758,7 +758,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -769,7 +769,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -780,7 +780,7 @@
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -791,7 +791,7 @@
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -802,7 +802,7 @@
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2419,7 +2419,7 @@
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
@@ -2470,7 +2470,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x30 &amp;&amp; arg1&lt;=0x39 || arg1&gt;=0x41 &amp;&amp; arg1 &lt;=0x5A || arg1&gt;=0x61 &amp;&amp; arg1 &lt;=0x7A</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2482,7 +2482,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x30 &amp;&amp; arg1&lt;=0x39 || arg1&gt;=0x41 &amp;&amp; arg1 &lt;=0x5A || arg1&gt;=0x61 &amp;&amp; arg1 &lt;=0x7A</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2493,7 +2493,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;='A' &amp;&amp; arg1&lt;='Z' || arg1&gt;='a' &amp;&amp; arg1 &lt;='z'</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2505,7 +2505,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;='A' &amp;&amp; arg1&lt;='Z' || arg1&gt;='a' &amp;&amp; arg1 &lt;='z'</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2516,7 +2516,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1==' ' || arg1=='\t'</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2539,7 +2539,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1==0x7F || arg1&lt;=0x1F</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2551,7 +2551,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1==0x7F || arg1&lt;=0x1F</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2576,7 +2576,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;='0' &amp;&amp; arg1&lt;='9'</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2588,7 +2588,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;='0' &amp;&amp; arg1&lt;='9'</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2599,7 +2599,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x21 &amp;&amp; arg1&lt;=0x7E</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2611,7 +2611,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x21 &amp;&amp; arg1&lt;=0x7E</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2622,7 +2622,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x61 &amp;&amp; arg1&lt;=0x7A</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2634,7 +2634,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x61 &amp;&amp; arg1&lt;=0x7A</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2645,7 +2645,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x20 &amp;&amp; arg1&lt;=0x7E</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2657,7 +2657,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x20 &amp;&amp; arg1&lt;=0x7E</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2668,7 +2668,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x21 &amp;&amp; arg1&lt;=0x2F || arg1&gt;=0x3A &amp;&amp; arg1&lt;=0x40 || arg1&gt;=0x5B &amp;&amp; arg1&lt;=0x60 || arg1&gt;=0x7B &amp;&amp; arg1&lt;=0x7E</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2680,7 +2680,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x21 &amp;&amp; arg1&lt;=0x2F || arg1&gt;=0x3A &amp;&amp; arg1&lt;=0x40 || arg1&gt;=0x5B &amp;&amp; arg1&lt;=0x60 || arg1&gt;=0x7B &amp;&amp; arg1&lt;=0x7E</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2691,7 +2691,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x09 &amp;&amp; arg1&lt;=0x0D || arg1==0x20</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2703,7 +2703,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x09 &amp;&amp; arg1&lt;=0x0D || arg1==0x20</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2714,7 +2714,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x41 &amp;&amp; arg1&lt;=0x5A</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2726,7 +2726,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x41 &amp;&amp; arg1&lt;=0x5A</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2737,7 +2737,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x30 &amp;&amp; arg1&lt;=0x39 || arg1&gt;=0x41 &amp;&amp; arg1&lt;=0x46 || arg1&gt;=0x61 &amp;&amp; arg1&lt;=0x66</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -2749,7 +2749,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int">arg1&gt;=0x30 &amp;&amp; arg1&lt;=0x39 || arg1&gt;=0x41 &amp;&amp; arg1&lt;=0x46 || arg1&gt;=0x61 &amp;&amp; arg1&lt;=0x66</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -4521,10 +4521,10 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="wchar_t"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
       <not-null/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
@@ -4545,12 +4545,12 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -4561,11 +4561,11 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="wchar_t"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -4576,12 +4576,12 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
@@ -4594,11 +4594,11 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
@@ -4608,11 +4608,11 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
       <minsize type="strlen" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
@@ -4623,10 +4623,10 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="wchar_t *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
@@ -4661,7 +4661,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="size_t">strlen(arg1)</returnValue>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
@@ -4672,15 +4672,15 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
       <minsize type="argvalue" arg="3"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -4692,20 +4692,20 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <noreturn>false</noreturn>
     <returnValue type="errno_t"/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
       <minsize type="argvalue" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-null/>
       <not-uninit/>
       <minsize type="argvalue" arg="4"/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -4730,17 +4730,17 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
       <not-null/>
       <not-uninit/>
       <strz/>
       <minsize type="argvalue" arg="3"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -4752,17 +4752,17 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="errno_t"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
       <not-null/>
       <not-uninit/>
       <strz/>
       <minsize type="argvalue" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
@@ -4772,21 +4772,21 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <noreturn>false</noreturn>
     <returnValue type="errno_t"/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
       <not-null/>
       <not-uninit/>
       <minsize type="argvalue" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-null/>
       <not-uninit/>
       <minsize type="argvalue" arg="4"/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -4795,17 +4795,17 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <noreturn>false</noreturn>
     <returnValue type="wchar_t *"/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
       <not-null/>
       <not-uninit/>
       <strz/>
       <minsize type="argvalue" arg="3"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -4818,15 +4818,15 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -4839,15 +4839,15 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -4859,12 +4859,12 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
@@ -4877,11 +4877,11 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="wchar_t *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
@@ -4892,12 +4892,12 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="size_t"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
@@ -5142,10 +5142,10 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
@@ -5155,24 +5155,24 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="2"/>
+    <arg nr="2" direction="out"/>
   </function>
   <!-- double strtod(const char *s, char **endp); -->
   <function name="strtod,std::strtod">
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="2"/>
+    <arg nr="2" direction="out"/>
   </function>
   <!-- long double strtold(const char *s, char **endp); -->
   <function name="strtold,std::strtold">
@@ -5180,12 +5180,12 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="2"/>
+    <arg nr="2" direction="out"/>
   </function>
   <!-- long strtol(const char *s, char **endp, int base); -->
   <function name="strtol,std::strtol">
@@ -5193,12 +5193,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="long"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="3">
+    <arg nr="2" direction="out"/>
+    <arg nr="3" direction="in">
       <not-uninit/>
       <valid>0,2:36</valid>
     </arg>
@@ -5209,12 +5210,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="unsigned long"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="3">
+    <arg nr="2" direction="out"/>
+    <arg nr="3" direction="in">
       <not-uninit/>
       <valid>0,2:36</valid>
     </arg>
@@ -5225,12 +5227,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="long long"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="3">
+    <arg nr="2" direction="out"/>
+    <arg nr="3" direction="in">
       <not-uninit/>
       <valid>0,2:36</valid>
     </arg>
@@ -5241,12 +5244,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="unsigned long long"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="3">
+    <arg nr="2" direction="out"/>
+    <arg nr="3" direction="in">
       <not-uninit/>
       <valid>0,2:36</valid>
     </arg>
@@ -5257,12 +5261,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="intmax_t"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="3">
+    <arg nr="2" direction="out"/>
+    <arg nr="3" direction="in">
       <not-uninit/>
       <valid>0,2:36</valid>
     </arg>
@@ -5273,12 +5278,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="uintmax_t"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <strz/>
     </arg>
-    <arg nr="3">
+    <arg nr="2" direction="out"/>
+    <arg nr="3" direction="in">
       <not-uninit/>
       <valid>0,2:36</valid>
     </arg>
@@ -5288,7 +5294,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="time_t"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-uninit/>
     </arg>
   </function>
@@ -5297,7 +5303,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-uninit/>
     </arg>
   </function>
@@ -5306,10 +5312,11 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="errno_t"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-uninit/>
+      <minsize type="argvalue" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
@@ -5326,7 +5333,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -5337,7 +5344,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:255</valid>
     </arg>
@@ -5381,11 +5388,11 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2"/>
+    <arg nr="2" direction="out"/>
   </function>
   <!-- double wcstod(const wchar_t *s, wchar ** endp); -->
   <function name="wcstod,std::wcstod">
@@ -5393,11 +5400,11 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2"/>
+    <arg nr="2" direction="out"/>
   </function>
   <!-- long double wcstold(const wchar_t *s, wchar ** endp); -->
   <function name="wcstold,std::wcstold">
@@ -5405,11 +5412,11 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2"/>
+    <arg nr="2" direction="out"/>
   </function>
   <!-- float stof (const string&  str, size_t* idx = 0); -->
   <!-- float stof (const wstring& str, size_t* idx = 0); -->
@@ -5418,10 +5425,10 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="float"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2" default="0">
+    <arg nr="2" default="0" direction="out">
       <not-uninit/>
     </arg>
   </function>
@@ -5432,10 +5439,10 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2" default="0">
+    <arg nr="2" default="0" direction="out">
       <not-uninit/>
     </arg>
   </function>
@@ -5446,10 +5453,10 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="long double"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2" default="0">
+    <arg nr="2" default="0" direction="out">
       <not-uninit/>
     </arg>
   </function>
@@ -5460,13 +5467,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2" default="0">
+    <arg nr="2" default="0" direction="out">
       <not-uninit/>
     </arg>
-    <arg nr="3" default="10">
+    <arg nr="3" default="10" direction="in">
       <not-uninit/>
       <valid>0,2:36</valid>
     </arg>
@@ -5478,13 +5485,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="long"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2" default="0">
+    <arg nr="2" default="0" direction="out">
       <not-uninit/>
     </arg>
-    <arg nr="3" default="10">
+    <arg nr="3" default="10" direction="in">
       <not-uninit/>
       <valid>0,2:36</valid>
     </arg>
@@ -5496,13 +5503,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="long long"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2" default="0">
+    <arg nr="2" default="0" direction="out">
       <not-uninit/>
     </arg>
-    <arg nr="3" default="10">
+    <arg nr="3" default="10" direction="in">
       <not-uninit/>
       <valid>0,2:36</valid>
     </arg>
@@ -5514,13 +5521,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="unsigned long"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2" default="0">
+    <arg nr="2" default="0" direction="out">
       <not-uninit/>
     </arg>
-    <arg nr="3" default="10">
+    <arg nr="3" default="10" direction="in">
       <not-uninit/>
       <valid>0,2:36</valid>
     </arg>
@@ -5532,13 +5539,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="unsigned long long"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2" default="0">
+    <arg nr="2" default="0" direction="out">
       <not-uninit/>
     </arg>
-    <arg nr="3" default="10">
+    <arg nr="3" default="10" direction="in">
       <not-uninit/>
       <valid>0,2:36</valid>
     </arg>
@@ -5557,7 +5564,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="std::string"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -5592,7 +5599,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="std::wstring"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -5817,16 +5824,16 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-uninit/>
       <minsize type="argvalue" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
     <formatstr/>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <formatstr/>
       <not-null/>
       <not-uninit/>
@@ -5837,15 +5844,15 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-uninit/>
       <minsize type="argvalue" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-null/>
       <not-uninit/>
       <formatstr/>
@@ -5858,7 +5865,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <noreturn>false</noreturn>
     <leak-ignore/>
     <formatstr scan="true"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <formatstr/>
       <not-null/>
       <not-uninit/>
@@ -5869,11 +5876,11 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
     <formatstr scan="true"/>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <formatstr/>
       <not-null/>
       <not-uninit/>
@@ -5888,7 +5895,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
       <not-uninit/>
     </arg>
     <formatstr scan="true"/>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <formatstr/>
       <not-uninit/>
     </arg>
@@ -5898,11 +5905,11 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
     <formatstr scan="true"/>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <formatstr/>
       <not-uninit/>
     </arg>
@@ -5912,7 +5919,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -6224,7 +6231,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <returnValue type="size_t"/>
     <use-retval/>
     <const/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -6741,7 +6748,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <noreturn>false</noreturn>
     <returnValue type="void"/>
     <leak-ignore/>
-    <arg nr="1" default="0">
+    <arg nr="1" default="0" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
diff --git a/lib/astutils.cpp b/lib/astutils.cpp
index bcd78c1a5..c77b6f758 100644
--- a/lib/astutils.cpp
+++ b/lib/astutils.cpp
@@ -886,8 +886,13 @@ bool isVariableChangedByFunctionCall(const Token *tok, const Settings *settings,
             if (argDirection == Library::ArgumentChecks::Direction::DIR_IN)
                 return false;
             else if (argDirection == Library::ArgumentChecks::Direction::DIR_OUT ||
-                     argDirection == Library::ArgumentChecks::Direction::DIR_INOUT)
-                return true;
+                     argDirection == Library::ArgumentChecks::Direction::DIR_INOUT) {
+                // With out or inout the direction of the content is specified, not a pointer itself, so ignore pointers for now
+                const ValueType * const valueType = tok1->valueType();
+                if (valueType && !valueType->pointer) {
+                    return true;
+                }
+            }
         }
 
         // if the library says 0 is invalid
diff --git a/lib/library.h b/lib/library.h
index bd4f16848..1fa4139fa 100644
--- a/lib/library.h
+++ b/lib/library.h
@@ -261,7 +261,12 @@ public:
         };
         std::vector<MinSize> minsizes;
 
-        enum Direction { DIR_IN, DIR_OUT, DIR_INOUT, DIR_UNKNOWN };
+        enum Direction {
+            DIR_IN,     ///< Input to called function. Data is treated as read-only.
+            DIR_OUT,    ///< Output to caller. Data is passed by reference or address and is potentially written.
+            DIR_INOUT,  ///< Input to called function, and output to caller. Data is passed by reference or address and is potentially modified.
+            DIR_UNKNOWN ///< direction not known / specified
+        };
         Direction direction;
     };
 
diff --git a/test/cfg/std.c b/test/cfg/std.c
index 05c5b5639..fcbd920e4 100644
--- a/test/cfg/std.c
+++ b/test/cfg/std.c
@@ -75,6 +75,18 @@ void bufferAccessOutOfBounds(void)
     fread(a,1,6,stdout);
 }
 
+void bufferAccessOutOfBounds_libraryDirectionConfiguration(void)
+{
+    // This tests whether the argument to isdigit() is configured with direction "in". This allows
+    // Cppcheck to report the error without marking it as inconclusive.
+    char arr[10];
+    char c = 'A';
+    (void)isdigit(c);
+    // cppcheck-suppress arrayIndexOutOfBounds
+    // cppcheck-suppress unreadVariable
+    arr[c] = 'x';
+}
+
 // memory leak
 
 void ignoreleak(void)
@@ -2580,18 +2592,18 @@ void uninitvar_remquo(void)
 
 void uninitvar_printf(char *Format, int Argument)
 {
-    char * format;
+    char * format_1, * format_2, * format_3;
     int argument1, argument2;
     // no warning is expected
     (void)printf("x");
     // cppcheck-suppress uninitvar
-    (void)printf(format,argument1);
+    (void)printf(format_1,argument1);
     // cppcheck-suppress uninitvar
     (void)printf(Format,argument2);
     // cppcheck-suppress uninitvar
-    (void)printf(format,Argument);
+    (void)printf(format_2,Argument);
     // cppcheck-suppress uninitvar
-    (void)printf(format,1);
+    (void)printf(format_3,1);
 
     // no warning is expected
     (void)printf(Format,Argument);
@@ -2869,14 +2881,14 @@ void bufferAccessOutOfBounds_strcat(char *dest, const char * const source)
 
 void uninitvar_wcscat(wchar_t *dest, const wchar_t * const source)
 {
-    wchar_t *deststr;
-    wchar_t *srcstr;
+    wchar_t *deststr_1, *deststr_2;
+    wchar_t *srcstr_1, *srcstr_2;
     // cppcheck-suppress uninitvar
-    (void)wcscat(deststr,srcstr);
+    (void)wcscat(deststr_1,srcstr_1);
     // cppcheck-suppress uninitvar
-    (void)wcscat(dest,srcstr);
+    (void)wcscat(dest,srcstr_2);
     // cppcheck-suppress uninitvar
-    (void)wcscat(deststr,source);
+    (void)wcscat(deststr_2,source);
 
     // no warning shall be shown for
     (void)wcscat(dest,source);
@@ -3022,13 +3034,13 @@ void uninitvar_strpbrk(void)
 
 void uninitvar_strncat(char *Ct, char *S, size_t N)
 {
-    char *ct;
+    char *ct_1, *ct_2;
     char *s;
     size_t n1, n2;
     // cppcheck-suppress uninitvar
-    (void)strncat(ct,s,n1);
+    (void)strncat(ct_1,s,n1);
     // cppcheck-suppress uninitvar
-    (void)strncat(ct,S,N);
+    (void)strncat(ct_2,S,N);
     // cppcheck-suppress uninitvar
     (void)strncat(Ct,s,N);
     // cppcheck-suppress uninitvar
@@ -3041,13 +3053,13 @@ void uninitvar_strncat(char *Ct, char *S, size_t N)
 // errno_t strcat_s(char *restrict dest, rsize_t destsz, const char *restrict src); // since C11
 void uninitvar_strcat_s(char *Ct, size_t N, char *S)
 {
-    char *ct;
+    char *ct_1, *ct_2;
     char *s;
     size_t n1, n2;
     // cppcheck-suppress uninitvar
-    (void)strcat_s(ct,n1,s);
+    (void)strcat_s(ct_1,n1,s);
     // cppcheck-suppress uninitvar
-    (void)strcat_s(ct,N,S);
+    (void)strcat_s(ct_2,N,S);
     // cppcheck-suppress uninitvar
     (void)strcat_s(Ct,N,s);
     // cppcheck-suppress uninitvar
@@ -3060,13 +3072,13 @@ void uninitvar_strcat_s(char *Ct, size_t N, char *S)
 // errno_t wcscat_s(wchar_t *restrict dest, rsize_t destsz, const wchar_t *restrict src); // since C11
 void uninitvar_wcscat_s(wchar_t *Ct, size_t N, wchar_t *S)
 {
-    wchar_t *ct;
+    wchar_t *ct_1, *ct_2;
     wchar_t *s;
     size_t n1, n2;
     // cppcheck-suppress uninitvar
-    (void)wcscat_s(ct,n1,s);
+    (void)wcscat_s(ct_1,n1,s);
     // cppcheck-suppress uninitvar
-    (void)wcscat_s(ct,N,S);
+    (void)wcscat_s(ct_2,N,S);
     // cppcheck-suppress uninitvar
     (void)wcscat_s(Ct,N,s);
     // cppcheck-suppress uninitvar
@@ -3078,7 +3090,7 @@ void uninitvar_wcscat_s(wchar_t *Ct, size_t N, wchar_t *S)
 
 void uninitvar_strncat_s(char *Ct, size_t N1, char *S, size_t N2)
 {
-    char *ct;
+    char *ct_1, *ct_2;
     char *s;
     size_t n1;
     size_t n2;
@@ -3086,9 +3098,9 @@ void uninitvar_strncat_s(char *Ct, size_t N1, char *S, size_t N2)
     size_t n4;
 
     // cppcheck-suppress uninitvar
-    (void)strncat_s(ct,n1,s,n2);
+    (void)strncat_s(ct_1,n1,s,n2);
     // cppcheck-suppress uninitvar
-    (void)strncat_s(ct,N1,S,N2);
+    (void)strncat_s(ct_2,N1,S,N2);
     // cppcheck-suppress uninitvar
     (void)strncat_s(Ct,n3,S,N2);
     // cppcheck-suppress uninitvar
@@ -3102,13 +3114,13 @@ void uninitvar_strncat_s(char *Ct, size_t N1, char *S, size_t N2)
 
 void uninitvar_wcsncat(wchar_t *Ct, wchar_t *S, size_t N)
 {
-    wchar_t *ct;
+    wchar_t *ct_1, *ct_2;
     wchar_t *s;
     size_t n1, n2;
     // cppcheck-suppress uninitvar
-    (void)wcsncat(ct,s,n1);
+    (void)wcsncat(ct_1,s,n1);
     // cppcheck-suppress uninitvar
-    (void)wcsncat(ct,S,N);
+    (void)wcsncat(ct_2,S,N);
     // cppcheck-suppress uninitvar
     (void)wcsncat(Ct,s,N);
     // cppcheck-suppress uninitvar
diff --git a/test/cfg/std.cpp b/test/cfg/std.cpp
index 0b276df7c..a61e8e7c7 100644
--- a/test/cfg/std.cpp
+++ b/test/cfg/std.cpp
@@ -1962,18 +1962,18 @@ void uninitvar_remquo(void)
 
 void uninivar_printf(char *Format, int Argument)
 {
-    char * format;
+    char * format_1, * format_2, * format_3;
     int argument1, argument2;
     // no warning is expected
     (void)std::printf("x");
     // cppcheck-suppress uninitvar
-    (void)std::printf(format,argument1);
+    (void)std::printf(format_1,argument1);
     // cppcheck-suppress uninitvar
     (void)std::printf(Format,argument2);
     // cppcheck-suppress uninitvar
-    (void)std::printf(format,Argument);
+    (void)std::printf(format_2,Argument);
     // cppcheck-suppress uninitvar
-    (void)std::printf(format,1);
+    (void)std::printf(format_3,1);
 
     // no warning is expected
     (void)std::printf(Format,Argument);
@@ -2251,14 +2251,14 @@ void uninitvar_strcat(char *dest, const char * const source)
 
 void uninitvar_wcscat(wchar_t *dest, const wchar_t * const source)
 {
-    wchar_t *deststr;
+    wchar_t *deststr_1, *deststr_2;
     wchar_t *srcstr;
     // cppcheck-suppress uninitvar
-    (void)std::wcscat(deststr,srcstr);
+    (void)std::wcscat(deststr_1,srcstr);
     // cppcheck-suppress uninitvar
     (void)std::wcscat(dest,srcstr);
     // cppcheck-suppress uninitvar
-    (void)std::wcscat(deststr,source);
+    (void)std::wcscat(deststr_2,source);
 
     // no warning shall be shown for
     (void)std::wcscat(dest,source);
@@ -2364,13 +2364,13 @@ void uninivar_strpbrk(void)
 
 void uninivar_strncat(char *Ct, char *S, size_t N)
 {
-    char *ct;
+    char *ct_1, *ct_2;
     char *s;
     size_t n1, n2;
     // cppcheck-suppress uninitvar
-    (void)std::strncat(ct,s,n1);
+    (void)std::strncat(ct_1,s,n1);
     // cppcheck-suppress uninitvar
-    (void)std::strncat(ct,S,N);
+    (void)std::strncat(ct_2,S,N);
     // cppcheck-suppress uninitvar
     (void)std::strncat(Ct,s,N);
     // cppcheck-suppress uninitvar
@@ -2382,13 +2382,13 @@ void uninivar_strncat(char *Ct, char *S, size_t N)
 
 void uninivar_wcsncat(wchar_t *Ct, wchar_t *S, size_t N)
 {
-    wchar_t *ct;
+    wchar_t *ct_1, *ct_2;
     wchar_t *s;
     size_t n1, n2;
     // cppcheck-suppress uninitvar
-    (void)std::wcsncat(ct,s,n1);
+    (void)std::wcsncat(ct_1,s,n1);
     // cppcheck-suppress uninitvar
-    (void)std::wcsncat(ct,S,N);
+    (void)std::wcsncat(ct_2,S,N);
     // cppcheck-suppress uninitvar
     (void)std::wcsncat(Ct,s,N);
     // cppcheck-suppress uninitvar
diff --git a/test/testlibrary.cpp b/test/testlibrary.cpp
index 7c3b77331..490ce9aae 100644
--- a/test/testlibrary.cpp
+++ b/test/testlibrary.cpp
@@ -49,6 +49,7 @@ private:
         TEST_CASE(function_arg);
         TEST_CASE(function_arg_any);
         TEST_CASE(function_arg_variadic);
+        TEST_CASE(function_arg_direction);
         TEST_CASE(function_arg_valid);
         TEST_CASE(function_arg_minsize);
         TEST_CASE(function_namespace);
@@ -273,6 +274,31 @@ private:
         ASSERT_EQUALS(true, library.isuninitargbad(tokenList.front(), 4));
     }
 
+    void function_arg_direction() const {
+        const char xmldata[] = "<?xml version=\"1.0\"?>\n"
+                               "<def>\n"
+                               "<function name=\"foo\">\n"
+                               "   <arg nr=\"1\" direction=\"in\"></arg>\n"
+                               "   <arg nr=\"2\" direction=\"out\"></arg>\n"
+                               "   <arg nr=\"3\" direction=\"inout\"></arg>\n"
+                               "   <arg nr=\"4\"></arg>\n"
+                               "</function>\n"
+                               "</def>";
+
+        Library library;
+        ASSERT_EQUALS(true, Library::OK == (readLibrary(library, xmldata)).errorcode);
+
+        TokenList tokenList(nullptr);
+        std::istringstream istr("foo(a,b,c,d);");
+        tokenList.createTokens(istr);
+        tokenList.front()->next()->astOperand1(tokenList.front());
+
+        ASSERT_EQUALS(Library::ArgumentChecks::Direction::DIR_IN, library.getArgDirection(tokenList.front(), 1));
+        ASSERT_EQUALS(Library::ArgumentChecks::Direction::DIR_OUT, library.getArgDirection(tokenList.front(), 2));
+        ASSERT_EQUALS(Library::ArgumentChecks::Direction::DIR_INOUT, library.getArgDirection(tokenList.front(), 3));
+        ASSERT_EQUALS(Library::ArgumentChecks::Direction::DIR_UNKNOWN, library.getArgDirection(tokenList.front(), 4));
+    }
+
     void function_arg_valid() const {
         const char xmldata[] = "<?xml version=\"1.0\"?>\n"
                                "<def>\n"