DynamoRIO / DynamoRIO/drmemory

uninit in NtWriteFile in browser_tests UsbApiTest.ZeroLengthTransfer

Open
#1,338 0 comments 0 reactions 0 assignees View on GitHub
Bug-FalsePositive Component-FullMode Migrated OpSys-Windows Priority-Medium
Dominant language
C
Stars
2.7k
Forks
290
PR merge metrics
No merged PRs in 30d

Description

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on September 18, 2013 23:17:19_

http://build.chromium.org/p/chromium.fyi/builders/Windows%20Browser%20%28DrMemory%20full%29%20%281%29/builds/870/steps/memory%20test%3A%20browser_tests/logs/stdio [ RUN ] UsbApiTest.ZeroLengthTransfer
[2044:1140:0918/180349:2695541:ERROR:chrome_views_delegate.cc(158)] NOT IMPLEMENTED
[2044:1140:0918/180351:2697148:ERROR:desktop_root_window_host_win.cc(671)] NOT IMPLEMENTED
[2044:1140:0918/180454:2760125:ERROR:desktop_root_window_host_win.cc(671)] NOT IMPLEMENTED
[2044:1140:0918/180500:2766365:ERROR:chrome_views_delegate.cc(158)] NOT IMPLEMENTED
[2396:3408:0918/180608:ERROR:renderer_main.cc(227)] Running without renderer sandbox
[2044:2096:0918/180717:2902929:ERROR:gpu_message_filter.cc(189)] Renderer 3 tried to access a surface for renderer 0
[2044:2096:0918/180717:2903584:ERROR:gpu_message_filter.cc(189)] Renderer 3 tried to access a surface for renderer 0
[2044:2096:0918/180719:2904925:ERROR:gpu_message_filter.cc(189)] Renderer 3 tried to access a surface for renderer 0
[2044:2096:0918/180719:2904925:ERROR:gpu_message_filter.cc(189)] Renderer 3 tried to access a surface for renderer 0
[2064:1568:0918/180918:ERROR:renderer_main.cc(227)] Running without renderer sandbox
[2064:1568:0918/181021:ERROR:base_feature_provider.cc(122)] manifestTypes: Allowing web_page contexts requires supplying a value for matches.
[2044:1140:0918/181101:3127180:ERROR:base_feature_provider.cc(122)] manifestTypes: Allowing web_page contexts requires supplying a value for matches.
~~2096~~
~~2096~~ Error `#1`: UNINITIALIZED READ: reading 0x486d1708-0x486d1709 1 byte(s) within 0x486d16d0-0x486d1728
~~2096~~ # 0 system call NtWriteFile parameter `#5`
~~2096~~ # 1 KERNELBASE.dll!WriteFile +0xa9 (0x76d8de58 )
~~2096~~ # 2 KERNEL32.dll!WriteFile +0x49 (0x764012cc )
~~2096~~ # 3 ipc.dll!IPC::Channel::ChannelImpl::ProcessOutgoingMessages [ipc\ipc_channel_win.cc:393]
~~2096~~ # 4 ipc.dll!IPC::Channel::ChannelImpl::Send [ipc\ipc_channel_win.cc:98]
~~2096~~ # 5 ipc.dll!IPC::Channel::Send [ipc\ipc_channel_win.cc:489]
~~2096~~ # 6 ipc.dll!IPC::ChannelProxy::Context::OnSendMessage [ipc\ipc_channel_proxy.cc:186]
~~2096~~ # 7 ipc.dll!base::internal::RunnableAdapter >)>::Run [base\bind_internal.h:190]
~~2096~~ Note: @0:10:40.964 in thread 2096
[2044:1140:0918/181118:3144028:INFO:CONSOLE(0)] "[SUCCESS] zeroLengthTransfer", source: chrome-extension://jhcbbbcgljllidpkamffgfpjoippglpp/_generated_background_page.html (0)
[ OK ] UsbApiTest.ZeroLengthTransfer (643353 ms)

Param `#5` is the buffer being written.

// Write to pipe...
Message\* m = output_queue_.front();
DCHECK(m->size() <= INT_MAX);
BOOL ok = WriteFile(pipe_,
m->data(),
static_cast(m->size()),
&bytes_written,
&output_state_.context.overlapped);

Could be legit padding in some data structure sent over the pipe? 0x8-0x9
is an odd place for padding though.

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=1338_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.