DynamoRIO / DynamoRIO/drmemory

false positive uninit read on __strncnt

Open
#2,237 1 comment 0 reactions 0 assignees View on GitHub
Bug-FalsePositive OpSys-Windows
Dominant language
C
Stars
2.7k
Forks
290
PR merge metrics
No merged PRs in 30d

Description

Running on win10 with a VS2017-built app using /guard:cf I see this:

```
~~Dr.M~~ Error #1: UNINITIALIZED READ: reading 0x000000bad00ff530-0x000000bad00ff531 1 byte(s)
~~Dr.M~~ # 0 __strncnt [minkernel\crts\ucrt\src\appcrt\string\strncnt.cpp:21]
~~Dr.M~~ # 1 __acrt_LCMapStringA_stat [minkernel\crts\ucrt\src\appcrt\locale\lcmapstringa.cpp:58]
~~Dr.M~~ # 2 __acrt_LCMapStringA [minkernel\crts\ucrt\src\appcrt\locale\lcmapstringa.cpp:224]
~~Dr.M~~ # 3 setSBUpLow [minkernel\crts\ucrt\src\appcrt\mbstring\mbctype.cpp:615]
~~Dr.M~~ # 4 _setmbcp_nolock [minkernel\crts\ucrt\src\appcrt\mbstring\mbctype.cpp:716]
~~Dr.M~~ # 5 setmbcp_internal [minkernel\crts\ucrt\src\appcrt\mbstring\mbctype.cpp:424]
~~Dr.M~~ # 6 __acrt_initialize_multibyte [minkernel\crts\ucrt\src\appcrt\mbstring\mbctype.cpp:852]
~~Dr.M~~ # 7 __acrt_execute_initializers [minkernel\crts\ucrt\src\appcrt\internal\shared_initialization.cpp:25]
~~Dr.M~~ # 8 __scrt_initialize_crt [f:\dd\vctools\crt\vcstartup\src\utility\utility.cpp:199]
~~Dr.M~~ # 9 __scrt_common_main_seh [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:232]
~~Dr.M~~ #10 KERNEL32.dll!BaseThreadInitThunk
~~Dr.M~~ Note: @0:00:01.203 in thread 12532
~~Dr.M~~ Note: instruction: cmp (%rax,%rcx) $0x00
```

It looks like strnlen and probably has to be suppressed in the same way as
a "legitimate" erroneous access:
```
0:000> Uf 00007ff6`97f010ba
cfguard!__strncnt+0x6 [minkernel\crts\ucrt\src\appcrt\string\strncnt.cpp @ 21]:
21 00007ff6`97f010b2 483bc2 cmp rax,rdx
21 00007ff6`97f010b5 7409 je cfguard!__strncnt+0x14 (00007ff6`97f010c0) Branch

cfguard!__strncnt+0xb [minkernel\crts\ucrt\src\appcrt\string\strncnt.cpp @ 21]:
21 00007ff6`97f010b7 48ffc0 inc rax

cfguard!__strncnt+0xe [minkernel\crts\ucrt\src\appcrt\string\strncnt.cpp @ 21]:
21 00007ff6`97f010ba 803c0800 cmp byte ptr [rax+rcx],0
21 00007ff6`97f010be 75f2 jne cfguard!__strncnt+0x6 (00007ff6`97f010b2) Branch

cfguard!__strncnt+0x14 [minkernel\crts\ucrt\src\appcrt\string\strncnt.cpp @ 24]:
24 00007ff6`97f010c0 c3 ret Branch
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.