google / google/sanitizers

MSAN: detect *all* uninitialized reads?

Open
#883 10 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
12.5k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

Hi.
This is related to https://github.com/google/oss-fuzz/issues/863

I'm fuzzing a [RawSpeed](https://github.com/darktable-org/rawspeed) library.
Memory sanitizer is being **extremely** useful to find one particular set
of issues in decoders - when they don't actually decode the whole image
(i.e. part of the memory is left uninitialized), but also don't report an issue.

Right now, MSAN seems to only detect uninitialized reads that are then
used (as conditional variable), so i'm [ab]using `MSAN_MEM_IS_INITIALIZED()`.
This works great, and at **this** moment has already found [~18 issues](https://bugs.chromium.org/p/oss-fuzz/issues/list?can=1&q=label%3AProj-librawspeed+uninitialized&colspec=ID+Type+Component+Status+Proj+Reported+Owner+Summary&cells=ids).

However, it's not quite what i would like it to be.
1. I need to manually plant `MSAN_MEM_IS_INITIALIZED()` calls.
2. Deduplication on oss-fuzz is having problems with that https://github.com/google/oss-fuzz/issues/863.
3. I can't call it everywhere, it is simply unfeasible as it would significantly affect the code readability e.g.

So i'm wondering whether
* there is already an option to instrument *all* reads? :) I guess not
* if not, whether such functionality is in scope of MSAN, and could be added?

Roman.

Contributor guide

Open the contributing guide

Research direction

No source file or test is named. Start by reviewing MSAN's handling of uninitialized reads and the MSAN_MEM_IS_INITIALIZED() interface, then compare the requested all-read instrumentation with oss-fuzz issue 863. Done would require a clear decision on whether this functionality is in scope and, if pursued, an implementation plan.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
testing-qa
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.