true uninitialized read in calc.exe!CUIController::SetDynamicFont

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on July 15, 2011 12:51:51_

xref issue #495

running calc start+stop on win7:

in event_basic_block(tag=0x00613a74)
in event_basic_block(tag=0x0061457b)
in event_basic_block(tag=0x0061458a)
Error `#2`: UNINITIALIZED READ: reading register eax
@0:00:18.037 in thread 3524
0x00614599 calc.exe!CUIController::SetDynamicFont
0x00613674 calc.exe!CUIController::UpdateTwoLineDisplay
0x00613565 calc.exe!CUIController::displayEvent
0x006133b9 calc.exe!CDisplayEvent::deliver
0x006134e2 calc.exe!CEventRegistry::fire
0x00613481 calc.exe!CCalculatorState::storeAndFire
0x00613a18 calc.exe!CCalculatorState::SetDisplayText
0x00614a54 calc.exe!CCalcEngine::DisplayNum
0x0061b499 calc.exe!CCalcEngine::SetRadixTypeAndNumWidth
0x0061b245 calc.exe!CCalcEngine::CCalcEngine
0x0061c0a1 calc.exe!CCalculatorController::setMode
0x0061c009 calc.exe!CUIController::SetCurrentMode
0x00614599 3b c3 cmp %eax %ebx

with REPORT_ALL_UNINIT, the memory source is found slightly earlier:
in event_basic_block(tag=0x00253a74)
in event_basic_block(tag=0x0025457b)
in event_basic_block(tag=0x0025458a)
Error `#70`: UNINITIALIZED READ: reading 0x029bea48-0x029bea4c 4 byte(s)
0x00254590 calc.exe!CUIController::SetDynamicFont
0x00253674 calc.exe!CUIController::UpdateTwoLineDisplay
...
0x00254590 8b 46 38 mov 0x38(%esi) -> %eax

followed by the same spot:
Error `#71`: UNINITIALIZED READ: reading register eax
0x00254599 3b c3 cmp %eax %ebx

no syscalls have mem addr like that as param

having all syscalls processed for unknown writes: still there

calc!CUIController::SetDynamicFont+0x102:
00f4457b 6a48 push 0x48
00f4457d ffb5ccfaffff push dword ptr [ebp-0x534]
00f44583 50 push eax
00f44584 ff15c811f400 call dword ptr [calc!_imp__MulDiv (00f411c8)]
00f4458a 8985d8faffff mov [ebp-0x528],eax
00f44590 8b4638 mov eax,[esi+0x38]
00f44593 899ddcfaffff mov [ebp-0x524],ebx
00f44599 3bc3 cmp eax,ebx

looks like esi holds "this":
calc!CUIController::SetDynamicFont+0x27:
00f444e9 8bf1 mov esi,ecx

0:000> dd @@(mc->esi)
0241e9f0 00f421ec 002400c4 00f42270 002491d8
0241ea00 0241ea38 00000000 00000000 00000000
0241ea10 00000000 00000000 00000000 00000000
0241ea20 00000000 00000000 00000000 00000000

just like for issue #495, it's easy to prove this one by showing it reading
0xbaadf00d natively:
0:000> bp calc!CUIController::CUIController
0:000> g
...
Breakpoint 0 hit
eax=00453d28 ebx=00000000 ecx=00453d28 edx=00453d23 esi=00844210 edi=00844210
0:000> dd ecx
00453d28 baadf00d baadf00d baadf00d baadf00d
00453d38 baadf00d baadf00d baadf00d baadf00d
00453d48 baadf00d baadf00d baadf00d baadf00d
00453d58 baadf00d baadf00d baadf00d abababab
0:000> ba r4 ecx+38
0:000> g
Breakpoint 1 hit
eax=baadf00d ebx=00000000 ecx=00000024 edx=00000024 esi=00453d28 edi=a5010a72
eip=007f4593 esp=0028d934 ebp=0028de9c iopl=0 nv up ei ng nz ac po cy
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000297
calc!CUIController::SetDynamicFont+0x11a:
007f4593 899ddcfaffff mov [ebp-0x524],ebx ss:002b:0028d978=00000000
0:000> dd 00453d28
00453d28 007f21ec baadf00d 007f2270 004549e8
00453d38 00454240 00000000 baadf00d 00000000
00453d48 baadf000 00000000 00000000 00000000
00453d58 00000000 00000000 baadf00d abababab

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=496_