Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 08 Jun 2022 19:17:50 +0000
From:      bugzilla-noreply@freebsd.org
To:        bugs@FreeBSD.org
Subject:   [Bug 231517] fts: causes error in valgrind
Message-ID:  <bug-231517-227-5YCtiYbSKM@https.bugs.freebsd.org/bugzilla/>
In-Reply-To: <bug-231517-227@https.bugs.freebsd.org/bugzilla/>
References:  <bug-231517-227@https.bugs.freebsd.org/bugzilla/>

next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D231517

--- Comment #1 from Paul Floyd <pjfloyd@wanadoo.fr> ---
With a debug build of libc I get

=3D=3D1494=3D=3D Conditional jump or move depends on uninitialised value(s)
=3D=3D1494=3D=3D    at 0x48F29D7: fts_close (lib/libc/gen/fts.c:256)
=3D=3D1494=3D=3D    by 0x2019B6: main (ftstest.c:17)
=3D=3D1494=3D=3D  Uninitialised value was created by a heap allocation
=3D=3D1494=3D=3D    at 0x484CBC4: malloc (vg_replace_malloc.c:397)
=3D=3D1494=3D=3D    by 0x48F2606: fts_alloc (lib/libc/gen/fts.c:1022)
=3D=3D1494=3D=3D    by 0x48F2606: fts_open (lib/libc/gen/fts.c:195)
=3D=3D1494=3D=3D    by 0x20197E: main (ftstest.c:13)

fts_open does this

        struct _fts_private *priv;

        if ((priv =3D calloc(1, sizeof(*priv))) =3D=3D NULL)
                return (NULL);

        sp =3D &priv->ftsp_fts;

        if ((sp->fts_cur =3D fts_alloc(sp, "", 0)) =3D=3D NULL)


where the first member of _fts_private is
        FTS             ftsp_fts;
meaning p[riv and sp are equivalent addresses.


And the error code is

        if (sp->fts_cur) {
                for (p =3D sp->fts_cur; p->fts_level >=3D FTS_ROOTLEVEL;) {=
 //
ERROR


It's what p points to that is not initialized:

gdb) p p
$5 =3D (FTSENT *) 0x54652d0
(gdb) p sizeof(*p)
$6 =3D 152
(gdb) mo check_memory defined 0x54652d0 152
Address 0x54652D0 len 152 not defined:
Uninitialised value at 0x54652D0 was created by a heap allocation
=3D=3D1649=3D=3D    at 0x484CBC4: malloc (vg_replace_malloc.c:397)
=3D=3D1649=3D=3D    by 0x48F2606: fts_alloc (lib/libc/gen/fts.c:1022)
=3D=3D1649=3D=3D    by 0x48F2606: fts_open (lib/libc/gen/fts.c:195)
=3D=3D1649=3D=3D    by 0x20197E: main (ftstest.c:13)
 Address 0x54652d0 is 0 bytes inside a block of size 377 alloc'd
=3D=3D1649=3D=3D    at 0x484CBC4: malloc (vg_replace_malloc.c:397)
=3D=3D1649=3D=3D    by 0x48F2606: fts_alloc (lib/libc/gen/fts.c:1022)
=3D=3D1649=3D=3D    by 0x48F2606: fts_open (lib/libc/gen/fts.c:195)
=3D=3D1649=3D=3D    by 0x20197E: main (ftstest.c:13)

[using vgdb and the monitor command]

As far as I'm concerned it's a bug in fts_open.

--=20
You are receiving this mail because:
You are the assignee for the bug.=



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-231517-227-5YCtiYbSKM>