google / google/sanitizers

MSan doesn't seem to instrument parse_printf_format

Open
#992 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
12.5k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

One of systemd fuzzers triggers a "use-of-uninitialized-value" warning, which I'm going to get around by manually initializing the array MSan is complaining about. I opened the issue here mostly because I need something to refer to in the commit message.
```sh
root@1c59ccf2eb06:/src/systemd# clang --version
clang version 7.0.0 (trunk 338452)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/local/bin

root@1c59ccf2eb06:/src/systemd# cat test.c
#include
#include

int main(int arc, char *argv[]) {
int _argtypes[128];
size_t _i, _k;
_k = parse_printf_format("%s", 128, _argtypes);
for (_i = 0; _i < _k; _i++)
if (_argtypes[_i] & PA_FLAG_PTR) {
printf("Found a pointer\n");
}
return 0;
}

root@1c59ccf2eb06:/src/systemd# clang -fsanitize-memory-track-origins -g -fsanitize=memory ./test.c -o a.out

root@1c59ccf2eb06:/src/systemd# ./a.out
==183==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x49bdaa in main /src/systemd/./test.c:9:7
#1 0x7f5eda5aa82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#2 0x41ae08 in _start (/src/systemd/a.out+0x41ae08)

Uninitialized value was created by an allocation of '_argtypes' in the stack frame of function 'main'
#0 0x49b770 in main /src/systemd/./test.c:4

SUMMARY: MemorySanitizer: use-of-uninitialized-value /src/systemd/./test.c:9:7 in main
Exiting
```

Contributor guide

Open the contributing guide

Research direction

Start with the standalone test.c reproducer and run the shown Clang MemorySanitizer command to confirm the warning from parse_printf_format. Trace whether the reported uninitialized array access is expected to be instrumented, and define done as an explained diagnosis or a clearly scoped change request.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
devtools, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.