DynamoRIO / DynamoRIO/drmemory

bitfield in glibc rbtree causes false pos UNINIT

Open
#162 1 comment 0 reactions 0 assignees View on GitHub
Bug-FalsePositive FalsePos-BitLevel Migrated OpSys-Linux Priority-Low
Dominant language
C
Stars
2.7k
Forks
290
PR merge metrics
No merged PRs in 30d

Description

_From [derek.br...@gmail.com](https://code.google.com/u/117968039472581148324/) on December 10, 2010 17:58:08_

PR 488813

I'm seeing errors like this:

Error `#1`: UNINITIALIZED READ 1 byte(s)
0x1f170582 libc.so.6!maybe_split_for_insert
/usr/src/debug/glibc-2.5-20061008T1257/misc/tsearch.c:177
0x1f0b8b88 libc.so.6!add_alias2
/usr/src/debug/glibc-2.5-20061008T1257/iconv/gconv_conf.c:149
0x1f0b91cd libc.so.6!__gconv_read_conf
/usr/src/debug/glibc-2.5-20061008T1257/iconv/gconv_conf.c:607
0x1e36fb10 libpthread.so.0!??
??:0
0x1f0c00d1 libc.so.6!_nl_find_locale
/usr/src/debug/glibc-2.5-20061008T1257/locale/findlocale.c:234
0x1f0bf849 libc.so.6!*__GI_setlocale
/usr/src/debug/glibc-2.5-20061008T1257/locale/setlocale.c:327

glibc-2.5/src/vmware/misc/tsearch.c:177 is:

```
if (parentp != NULL && (*parentp)->red)
```

d0582: f6 46 0c 01 testb $0x1,0xc(%esi)

it implements
root->red = 1;
by only setting the bottom-most bit:
d054c: 80 48 0c 01 orb $0x1,0xc(%eax)

and the "red" field is indeed a bitfield:

typedef struct node_t
{
/\* Callers expect this to be the first element in the structure - do not
move! */
const void *key;
struct node_t *left;
struct node_t *right;
unsigned int red:1;
} *node;

so, not surprising to get an UNINIT. we'll need PR 408523 to remove this
false positive.

These suppression improvements are only implemented in postprocess.pl for
mod!func callstacks so I'll leave these cases open to cover adding support
to report.c for mod+offs callstacks:

In suppress-default.txt I have:
- PR 523512: python deliberate UNADDR
- PR 488813: tsearch bitfields
- PR 525272: ld-linux.so UNINIT and strlen UNADDR
already committed separately UNADDR fix for accesses to DR+client libs

Testing done:
- loader on linux

Will come in future diff:
- generalize and clean up loader.c test
- add wildcard suppression tests
- getting an uninit on return value of dlopen: need more analysis of
these PR 525272 loader uninits

lowering priority since now suppressed by default
leaving open so we can test this once we have PR 408523

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=162_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.