[MSAN] Does not detect uninitialized large (800+ bytes) structs across function calls
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
```c
// -Wall -Wextra -Wpedantic -fsanitize=memory -g -fno-inline-functions
#include
#include
#include
typedef struct s_large_struct
{
char arr[800]; // With 799 the error is detected
char other;
} t_large_struct;
void use_uninit(t_large_struct s)
{
printf("el: %i\n", s.other);
}
int main(void)
{
t_large_struct s;
use_uninit(s);
}
```
[Godbolt](https://godbolt.org/z/317fW5czh)
For some reason msan stops tracking uninitialized structs across function calls when the function inlining is disabled, and the struct is larger then 800 bytes.
Here is a version that can be compiled with no warnings
```c
#include
typedef struct s_large_struct
{
char other;
char arr[800]; // With 799 the error is detected
} t_large_struct;
void use_uninit(t_large_struct s)
{
printf("el: %i\n", s.other);
}
t_large_struct get_uninit_struct(void) {
t_large_struct ret;
ret.arr[0] = 0;
return ret;
}
int main(void)
{
t_large_struct s = get_uninit_struct();
use_uninit(s);
}
```
Contributor guide
Research direction
Start by reproducing the supplied C examples with -fsanitize=memory, -fno-inline-functions, and the 799- versus 800-byte arrays. Compare MSAN's handling of use_uninit and get_uninit_struct across the function call; done means the uninitialized s.other use is detected in both examples.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100