Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

out_ascii.c: 2 * possible reads of bad data ? #5

Closed
dcb314 opened this issue Mar 28, 2014 · 1 comment
Closed

out_ascii.c: 2 * possible reads of bad data ? #5

dcb314 opened this issue Mar 28, 2014 · 1 comment

Comments

@dcb314
Copy link

dcb314 commented Mar 28, 2014

out_ascii.c:62:6: warning: variable 'tx1prec' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized]
out_ascii.c:67:6: warning: variable 'tx2prec' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized]

Suggest initialise local variable tx1prec and tx2prec at their declarations.

@tgraf
Copy link
Owner

tgraf commented May 6, 2014

Fixed in:

commit e0efec0
Author: Thomas Graf tgraf@suug.ch
Date: Tue May 6 15:01:53 2014 +0200

ascii: Initialize prec variables

Ensure that branching does not leave behind uninitialized variables

Reported-by: dcb314
Signed-off-by: Thomas Graf <tgraf@suug.ch>

diff --git a/src/out_ascii.c b/src/out_ascii.c
index 40a70e2..b3e8d2d 100644
--- a/src/out_ascii.c
+++ b/src/out_ascii.c
@@ -55,7 +55,7 @@ static void print_list(struct element *e)
{
char *rxu1 = "", *txu1 = "", *rxu2 = "", *txu2 = "";
double rx1 = 0.0f, tx1 = 0.0f, rx2 = 0.0f, tx2 = 0.0f;

  •   int rx1prec, tx1prec, rx2prec, tx2prec;
    
  •   int rx1prec = 0, tx1prec = 0, rx2prec = 0, tx2prec = 0;
    char pad[IFNAMSIZ + 32];
    struct attr *a;
    

@tgraf tgraf closed this as completed May 6, 2014
dcaratti added a commit to dcaratti/bmon that referenced this issue Nov 3, 2022
when elements' lifetime reaches 0, and program is compiled with debug, bmon
gets a segmentation fault:

 Program received signal SIGSEGV, Segmentation fault.
                                                    __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74
 Downloading 0.00 MB source file /usr/src/debug/glibc-2.34-43.fc35.x86_64/string/../sysdeps/x86_64/multiarch/strlen-avx2.S
 74              VPCMPEQ (%rdi), %ymm0, %ymm1
 (gdb) bt
 #0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74
 tgraf#1  0x00007ffff7a84228 in __vfprintf_internal (s=s@entry=0x7fffffffb9f0,
     format=0x410f08 "[DBG] %20s:%-4u %s: Deleting dead element %s\n", ap=0x7fffffffdb30, mode_flags=0)
     at vfprintf-internal.c:1647
 tgraf#2  0x00007ffff7a849ef in buffered_vfprintf (s=0x7ffff7bfb6a0 <_IO_2_1_stderr_>,
     format=format@entry=0x410f08 "[DBG] %20s:%-4u %s: Deleting dead element %s\n", args=args@entry=0x7fffffffdb30,
     mode_flags=mode_flags@entry=0) at vfprintf-internal.c:2295
 tgraf#3  0x00007ffff7a839cb in __vfprintf_internal (s=<optimized out>,
     format=0x410f08 "[DBG] %20s:%-4u %s: Deleting dead element %s\n", ap=ap@entry=0x7fffffffdb30,
     mode_flags=mode_flags@entry=0) at vfprintf-internal.c:1377
 tgraf#4  0x00007ffff7a6f3ca in __fprintf (stream=<optimized out>, format=<optimized out>) at fprintf.c:32
 tgraf#5  0x0000000000406339 in __group_foreach_element (g=g@entry=0x422ae0, list=list@entry=0x4da940,
     cb=cb@entry=0x407260 <element_check_if_dead>, arg=arg@entry=0x0) at group.c:45
 tgraf#6  0x0000000000406351 in __group_foreach_element (g=g@entry=0x422ae0, list=list@entry=0x4d6d40,
     cb=cb@entry=0x407260 <element_check_if_dead>, arg=arg@entry=0x0) at group.c:48
 tgraf#7  0x0000000000406351 in __group_foreach_element (g=0x422ae0, list=0x422af0, cb=0x407260 <element_check_if_dead>,
     arg=arg@entry=0x0) at group.c:48
 tgraf#8  0x0000000000406750 in group_foreach_recursive (arg=0x0, cb=<optimized out>) at group.c:67
 tgraf#9  free_unused_elements () at group.c:192
 tgraf#10 0x00000000004041f0 in main (argc=<optimized out>, argv=0x7fffffffdfb8) at bmon.c:350
 (gdb)

this happens because 'e->e_name' is used by 'DBG()' after the call to
element_free(e); calling DBG(...) before element_free() proved to fix the
above crash.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants