mirror of
https://github.com/Zenithsiz/ftmemsim-valgrind.git
synced 2026-02-03 10:05:29 +00:00
eb2b193943
Some syscall verification code is allocating memory to generate
the string used to build an error, e.g. syswrap-generic.c verifying fields of
e.g socket addresses (pre_mem_read_sockaddr) or sendmsg/recvmsg args
(msghdr_foreachfield)
The allocated pointer was copied in the error created by VG_(maybe_record_error).
This was wrong for 2 reasons:
1. If the error is a new error, it is stored in a list of errors,
but the string memory was freed by pre_mem_read_sockaddr, msghdr_foreachfield, ...
This causes a dangling reference. Was at least visible when giving -v, which
re-prints all errors at the end of execution.
Probably this could have some consequences during run while generating new errors,
and comparing for equality with a recorded error having a dangling reference.
2. the same allocated string is re-used for each piece/field of the verified struct.
The code in mc_errors.c that checks that 2 errors are identical was then wrongly
considereing that 2 successive errors for 2 different fields for the same syscall
arg are identical, just because the error string happened to be produced at
the same address.
(it is believed that initially, the error string was assumed to be a static
string, which is not the case anymore, causing the above 2 problems).
Changes:
* The fix consists in duplicating in m_errormgr.c the given error string when
the error is recorded. In other words, the error string is now duplicated similarly
to the (optional) extra component of the error.
* memcheck/tests/linux/rfcomm.c test modified as now an error is reported
for each uninit field.
* socketaddr unknown family is also better reported (using sa_data field name,
rather than an empty field name.
* minor reformatting in m_errormgr.c, to be below 80 characters.
Some notes:
1. the string is only duplicated if the error is recorded
(ie. printed or the first time an error matches a suppression).
The string is not duplicated for duplicated errors or following errors
matching the first (suppressed) error.
The string is also not duplicated for 'unique errors' (that are printed
and then not recorded).
2. duplicating the string for each recorded error is not deemed to
use a lot of memory:
* error strings are usually NULL or short (often 10 bytes or so).
* we expect no program has a huge number of errors
If ever this string duplicate would be significant, having a DedupPoolAlloc
in m_errormgr.c for these strings would reduce this memory (as we expect to
have very few different strings, even with millions of errors).
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@14214
65 lines
2.4 KiB
Plaintext
65 lines
2.4 KiB
Plaintext
Syscall param socketcall.bind(my_addr.sa_family) points to uninitialised byte(s)
|
|
...
|
|
by 0x........: main (rfcomm.c:53)
|
|
Address 0x........ is on thread 1's stack
|
|
in frame #1, created by main (rfcomm.c:26)
|
|
Uninitialised value was created by a client request
|
|
at 0x........: main (rfcomm.c:45)
|
|
|
|
Syscall param socketcall.bind(my_addr.rc_bdaddr) points to uninitialised byte(s)
|
|
...
|
|
by 0x........: main (rfcomm.c:53)
|
|
Address 0x........ is on thread 1's stack
|
|
in frame #1, created by main (rfcomm.c:26)
|
|
Uninitialised value was created by a client request
|
|
at 0x........: main (rfcomm.c:45)
|
|
|
|
Syscall param socketcall.bind(my_addr.rc_channel) points to uninitialised byte(s)
|
|
...
|
|
by 0x........: main (rfcomm.c:53)
|
|
Address 0x........ is on thread 1's stack
|
|
in frame #1, created by main (rfcomm.c:26)
|
|
Uninitialised value was created by a client request
|
|
at 0x........: main (rfcomm.c:45)
|
|
|
|
Syscall param socketcall.bind(my_addr.sa_family) points to uninitialised byte(s)
|
|
...
|
|
by 0x........: main (rfcomm.c:59)
|
|
Address 0x........ is on thread 1's stack
|
|
in frame #1, created by main (rfcomm.c:26)
|
|
Uninitialised value was created by a client request
|
|
at 0x........: main (rfcomm.c:58)
|
|
|
|
Syscall param socketcall.bind(my_addr.sa_data) points to uninitialised byte(s)
|
|
...
|
|
by 0x........: main (rfcomm.c:59)
|
|
Address 0x........ is on thread 1's stack
|
|
in frame #1, created by main (rfcomm.c:26)
|
|
Uninitialised value was created by a client request
|
|
at 0x........: main (rfcomm.c:58)
|
|
|
|
Syscall param socketcall.bind(my_addr.rc_bdaddr) points to uninitialised byte(s)
|
|
...
|
|
by 0x........: main (rfcomm.c:63)
|
|
Address 0x........ is on thread 1's stack
|
|
in frame #1, created by main (rfcomm.c:26)
|
|
Uninitialised value was created by a client request
|
|
at 0x........: main (rfcomm.c:58)
|
|
|
|
Syscall param socketcall.bind(my_addr.rc_channel) points to uninitialised byte(s)
|
|
...
|
|
by 0x........: main (rfcomm.c:63)
|
|
Address 0x........ is on thread 1's stack
|
|
in frame #1, created by main (rfcomm.c:26)
|
|
Uninitialised value was created by a client request
|
|
at 0x........: main (rfcomm.c:58)
|
|
|
|
Syscall param socketcall.bind(my_addr.rc_channel) points to uninitialised byte(s)
|
|
...
|
|
by 0x........: main (rfcomm.c:67)
|
|
Address 0x........ is on thread 1's stack
|
|
in frame #1, created by main (rfcomm.c:26)
|
|
Uninitialised value was created by a client request
|
|
at 0x........: main (rfcomm.c:58)
|
|
|