incubator-stdcxx-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Travis Vitek (JIRA)" <j...@apache.org>
Subject [jira] Updated: (STDCXX-581) purify reports uninitialized memory read in __rw_memattr
Date Mon, 08 Oct 2007 22:07:52 GMT

     [ https://issues.apache.org/jira/browse/STDCXX-581?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Travis Vitek updated STDCXX-581:
--------------------------------

    Attachment: stdcxx-581.patch
                0.char.log

Attaching sample output from purify showing the issue being fixed and a patch to fix it.

2007-10-08  Travis Vitek  <vitek@roguewave.com>

	STDCXX-581
	* printf.cpp (_rw_fmtstr): Provide reasonable length value
	to call to __rw_memattr() to avoid touching uninitialized
	memory.
	(_rwfmtwstr): Ditto.
	(_rwfmtarray): Ditto.

> purify reports uninitialized memory read in __rw_memattr
> --------------------------------------------------------
>
>                 Key: STDCXX-581
>                 URL: https://issues.apache.org/jira/browse/STDCXX-581
>             Project: C++ Standard Library
>          Issue Type: Improvement
>          Components: Test Driver
>            Reporter: Travis Vitek
>            Assignee: Travis Vitek
>             Fix For: 4.2.1
>
>         Attachments: 0.char.log, stdcxx-581.patch
>
>
> __rw_memattr() checks that a specified block of memory is addressable for reading or
writing. It takes a pointer and a length. If the length is _RWSTD_SIZE_MAX, then it is assumed
that the pointer refers to a null terminated string and the number of bytes is counted via
a call to memchr() or strchr(). Unfortunately, sof the formatted io functions in printf.cpp
cause __rw_memattr() to unnecessarily touch uninitialized memory or even worse to look for
the null terminator in a buffer that is not null terminated.
> An example of this is _rw_fmtlong(). It allocates a buffer of 130 chars and formats a
long value into that buffer without null terminating the buffer [it appears that this is intentional].
It then calls _rw_fmtstr() on the result. Internally _rw_fmtstr() calls __rw_memattr() with
_RWSTD_SIZE_MAX as the number of bytes to verify read/write access to. Because the buffer
is not null terminated, the __rw_memattr() call could walk past the end of the array looking
for a null terminator.
> I believe that the call to __rw_memattr() in _rw_fmtlong() should be getting the actual
length of the string that is being formatted so as to avoid reading past the end of the source
array. I see no reason to allow __rw_memattr() to go looking for a null terminator when we
don't know that there is one there. This same problem occurs in _rw_fmtwstr() and _rw_fmtarray().

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


Mime
View raw message