No msan warning using printf on purposely poisoned memory
- Dominant language
- C
- Stars
- 12.5k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
On Ubuntu 14.04 using clang version 3.9.0 (branches/release_39 280336) a small test program doesn't generate the expected memory sanitizer warnings:
``` c
#include
#if __has_feature(memory_sanitizer)
#include
#else
#define __msan_poison(addr, size) do {} while (0)
#define __msan_print_shadow(addr, size) do {} while (0)
#endif
int main(void) {
volatile int *i = (int *) malloc(sizeof(int));
__msan_poison(i, sizeof(int));
__msan_print_shadow(i, sizeof(int));
printf("%d\n", *i);
*i = 1;
__msan_print_shadow(i, sizeof(int));
printf("%d\n", *i);
}
```
Compiling with
`clang-3.9 -U_FORTIFY_SOURCE -O1 -g -fsanitize=memory -fPIE -pie umr.c -o umr`
and then running
`MSAN_OPTIONS='check_printf=1' ./umr`
shows that msan believes the address to be poisoned but there's no error when printf does the first access. Compiling the program without `-fsanitize=memory` and running it under valgrind triggers `Conditional jump or move depends on uninitialised value` warnings inside `vfprintf`.
Contributor guide
Assessment
This issue has not been assessed yet.