google / google/sanitizers

No msan warning using printf on purposely poisoned memory

Open
#718 7 comments 1 reaction 2 assignees Claimed by @eugenis View on GitHub
Dominant language
C
Stars
12.5k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

On Ubuntu 14.04 using clang version 3.9.0 (branches/release_39 280336) a small test program doesn't generate the expected memory sanitizer warnings:

``` c
#include
#if __has_feature(memory_sanitizer)
#include
#else
#define __msan_poison(addr, size) do {} while (0)
#define __msan_print_shadow(addr, size) do {} while (0)
#endif

int main(void) {
volatile int *i = (int *) malloc(sizeof(int));
__msan_poison(i, sizeof(int));
__msan_print_shadow(i, sizeof(int));
printf("%d\n", *i);
*i = 1;
__msan_print_shadow(i, sizeof(int));
printf("%d\n", *i);
}
```

Compiling with
`clang-3.9 -U_FORTIFY_SOURCE -O1 -g -fsanitize=memory -fPIE -pie umr.c -o umr`
and then running
`MSAN_OPTIONS='check_printf=1' ./umr`
shows that msan believes the address to be poisoned but there's no error when printf does the first access. Compiling the program without `-fsanitize=memory` and running it under valgrind triggers `Conditional jump or move depends on uninitialised value` warnings inside `vfprintf`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.