llvm / llvm/llvm-project

[MSAN] Does not detect uninitialized large (800+ bytes) structs across function calls

Open
#169,108 1 comment 0 reactions 0 assignees View on GitHub
compiler-rt:msan
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

```c
// -Wall -Wextra -Wpedantic -fsanitize=memory -g -fno-inline-functions
#include
#include
#include

typedef struct s_large_struct
{
char arr[800]; // With 799 the error is detected
char other;
} t_large_struct;

void use_uninit(t_large_struct s)
{
printf("el: %i\n", s.other);
}

int main(void)
{
t_large_struct s;
use_uninit(s);
}
```
[Godbolt](https://godbolt.org/z/317fW5czh)

For some reason msan stops tracking uninitialized structs across function calls when the function inlining is disabled, and the struct is larger then 800 bytes.

Here is a version that can be compiled with no warnings
```c
#include

typedef struct s_large_struct
{
char other;
char arr[800]; // With 799 the error is detected
} t_large_struct;

void use_uninit(t_large_struct s)
{
printf("el: %i\n", s.other);
}

t_large_struct get_uninit_struct(void) {
t_large_struct ret;
ret.arr[0] = 0;
return ret;
}

int main(void)
{
t_large_struct s = get_uninit_struct();
use_uninit(s);
}
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the supplied C examples with -fsanitize=memory, -fno-inline-functions, and the 799- versus 800-byte arrays. Compare MSAN's handling of use_uninit and get_uninit_struct across the function call; done means the uninitialized s.other use is detected in both examples.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.