You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@stdcxx.apache.org by "Travis Vitek (JIRA)" <ji...@apache.org> on 2007/10/08 23:45:50 UTC
[jira] Created: (STDCXX-581) purify reports uninitialized memory
read in __rw_memattr
purify reports uninitialized memory read in __rw_memattr
--------------------------------------------------------
Key: STDCXX-581
URL: https://issues.apache.org/jira/browse/STDCXX-581
Project: C++ Standard Library
Issue Type: Improvement
Components: Test Driver
Reporter: Travis Vitek
Assignee: Travis Vitek
Fix For: 4.2.1
__rw_memattr() checks that a specified block of memory is addressable for reading or writing. It takes a pointer and a length. If the length is _RWSTD_SIZE_MAX, then it is assumed that the pointer refers to a null terminated string and the number of bytes is counted via a call to memchr() or strchr(). Unfortunately, sof the formatted io functions in printf.cpp cause __rw_memattr() to unnecessarily touch uninitialized memory or even worse to look for the null terminator in a buffer that is not null terminated.
An example of this is _rw_fmtlong(). It allocates a buffer of 130 chars and formats a long value into that buffer without null terminating the buffer [it appears that this is intentional]. It then calls _rw_fmtstr() on the result. Internally _rw_fmtstr() calls __rw_memattr() with _RWSTD_SIZE_MAX as the number of bytes to verify read/write access to. Because the buffer is not null terminated, the __rw_memattr() call could walk past the end of the array looking for a null terminator.
I believe that the call to __rw_memattr() in _rw_fmtlong() should be getting the actual length of the string that is being formatted so as to avoid reading past the end of the source array. I see no reason to allow __rw_memattr() to go looking for a null terminator when we don't know that there is one there. This same problem occurs in _rw_fmtwstr() and _rw_fmtarray().
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (STDCXX-581) purify reports uninitialized memory
read in __rw_memattr
Posted by "Farid Zaripov (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/STDCXX-581?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Farid Zaripov resolved STDCXX-581.
----------------------------------
Resolution: Fixed
> purify reports uninitialized memory read in __rw_memattr
> --------------------------------------------------------
>
> Key: STDCXX-581
> URL: https://issues.apache.org/jira/browse/STDCXX-581
> Project: C++ Standard Library
> Issue Type: Improvement
> Components: Test Driver
> Affects Versions: 4.2.0
> Reporter: Travis Vitek
> Assignee: Travis Vitek
> Fix For: 4.2.1
>
> Attachments: 0.char.log, stdcxx-581.patch
>
>
> __rw_memattr() checks that a specified block of memory is addressable for reading or writing. It takes a pointer and a length. If the length is _RWSTD_SIZE_MAX, then it is assumed that the pointer refers to a null terminated string and the number of bytes is counted via a call to memchr() or strchr(). Unfortunately, sof the formatted io functions in printf.cpp cause __rw_memattr() to unnecessarily touch uninitialized memory or even worse to look for the null terminator in a buffer that is not null terminated.
> An example of this is _rw_fmtlong(). It allocates a buffer of 130 chars and formats a long value into that buffer without null terminating the buffer [it appears that this is intentional]. It then calls _rw_fmtstr() on the result. Internally _rw_fmtstr() calls __rw_memattr() with _RWSTD_SIZE_MAX as the number of bytes to verify read/write access to. Because the buffer is not null terminated, the __rw_memattr() call could walk past the end of the array looking for a null terminator.
> I believe that the call to __rw_memattr() in _rw_fmtlong() should be getting the actual length of the string that is being formatted so as to avoid reading past the end of the source array. I see no reason to allow __rw_memattr() to go looking for a null terminator when we don't know that there is one there. This same problem occurs in _rw_fmtwstr() and _rw_fmtarray().
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (STDCXX-581) purify reports uninitialized memory
read in __rw_memattr
Posted by "Travis Vitek (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/STDCXX-581?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Travis Vitek updated STDCXX-581:
--------------------------------
Attachment: stdcxx-581.patch
> purify reports uninitialized memory read in __rw_memattr
> --------------------------------------------------------
>
> Key: STDCXX-581
> URL: https://issues.apache.org/jira/browse/STDCXX-581
> Project: C++ Standard Library
> Issue Type: Improvement
> Components: Test Driver
> Reporter: Travis Vitek
> Assignee: Travis Vitek
> Fix For: 4.2.1
>
> Attachments: 0.char.log, stdcxx-581.patch
>
>
> __rw_memattr() checks that a specified block of memory is addressable for reading or writing. It takes a pointer and a length. If the length is _RWSTD_SIZE_MAX, then it is assumed that the pointer refers to a null terminated string and the number of bytes is counted via a call to memchr() or strchr(). Unfortunately, sof the formatted io functions in printf.cpp cause __rw_memattr() to unnecessarily touch uninitialized memory or even worse to look for the null terminator in a buffer that is not null terminated.
> An example of this is _rw_fmtlong(). It allocates a buffer of 130 chars and formats a long value into that buffer without null terminating the buffer [it appears that this is intentional]. It then calls _rw_fmtstr() on the result. Internally _rw_fmtstr() calls __rw_memattr() with _RWSTD_SIZE_MAX as the number of bytes to verify read/write access to. Because the buffer is not null terminated, the __rw_memattr() call could walk past the end of the array looking for a null terminator.
> I believe that the call to __rw_memattr() in _rw_fmtlong() should be getting the actual length of the string that is being formatted so as to avoid reading past the end of the source array. I see no reason to allow __rw_memattr() to go looking for a null terminator when we don't know that there is one there. This same problem occurs in _rw_fmtwstr() and _rw_fmtarray().
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (STDCXX-581) purify reports uninitialized memory
read in __rw_memattr
Posted by "Travis Vitek (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/STDCXX-581?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Travis Vitek updated STDCXX-581:
--------------------------------
Attachment: (was: stdcxx-581.patch)
> purify reports uninitialized memory read in __rw_memattr
> --------------------------------------------------------
>
> Key: STDCXX-581
> URL: https://issues.apache.org/jira/browse/STDCXX-581
> Project: C++ Standard Library
> Issue Type: Improvement
> Components: Test Driver
> Reporter: Travis Vitek
> Assignee: Travis Vitek
> Fix For: 4.2.1
>
> Attachments: 0.char.log, stdcxx-581.patch
>
>
> __rw_memattr() checks that a specified block of memory is addressable for reading or writing. It takes a pointer and a length. If the length is _RWSTD_SIZE_MAX, then it is assumed that the pointer refers to a null terminated string and the number of bytes is counted via a call to memchr() or strchr(). Unfortunately, sof the formatted io functions in printf.cpp cause __rw_memattr() to unnecessarily touch uninitialized memory or even worse to look for the null terminator in a buffer that is not null terminated.
> An example of this is _rw_fmtlong(). It allocates a buffer of 130 chars and formats a long value into that buffer without null terminating the buffer [it appears that this is intentional]. It then calls _rw_fmtstr() on the result. Internally _rw_fmtstr() calls __rw_memattr() with _RWSTD_SIZE_MAX as the number of bytes to verify read/write access to. Because the buffer is not null terminated, the __rw_memattr() call could walk past the end of the array looking for a null terminator.
> I believe that the call to __rw_memattr() in _rw_fmtlong() should be getting the actual length of the string that is being formatted so as to avoid reading past the end of the source array. I see no reason to allow __rw_memattr() to go looking for a null terminator when we don't know that there is one there. This same problem occurs in _rw_fmtwstr() and _rw_fmtarray().
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (STDCXX-581) purify reports uninitialized memory
read in __rw_memattr
Posted by "Travis Vitek (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/STDCXX-581?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Travis Vitek updated STDCXX-581:
--------------------------------
Attachment: stdcxx-581.patch
0.char.log
Attaching sample output from purify showing the issue being fixed and a patch to fix it.
2007-10-08 Travis Vitek <vi...@roguewave.com>
STDCXX-581
* printf.cpp (_rw_fmtstr): Provide reasonable length value
to call to __rw_memattr() to avoid touching uninitialized
memory.
(_rwfmtwstr): Ditto.
(_rwfmtarray): Ditto.
> purify reports uninitialized memory read in __rw_memattr
> --------------------------------------------------------
>
> Key: STDCXX-581
> URL: https://issues.apache.org/jira/browse/STDCXX-581
> Project: C++ Standard Library
> Issue Type: Improvement
> Components: Test Driver
> Reporter: Travis Vitek
> Assignee: Travis Vitek
> Fix For: 4.2.1
>
> Attachments: 0.char.log, stdcxx-581.patch
>
>
> __rw_memattr() checks that a specified block of memory is addressable for reading or writing. It takes a pointer and a length. If the length is _RWSTD_SIZE_MAX, then it is assumed that the pointer refers to a null terminated string and the number of bytes is counted via a call to memchr() or strchr(). Unfortunately, sof the formatted io functions in printf.cpp cause __rw_memattr() to unnecessarily touch uninitialized memory or even worse to look for the null terminator in a buffer that is not null terminated.
> An example of this is _rw_fmtlong(). It allocates a buffer of 130 chars and formats a long value into that buffer without null terminating the buffer [it appears that this is intentional]. It then calls _rw_fmtstr() on the result. Internally _rw_fmtstr() calls __rw_memattr() with _RWSTD_SIZE_MAX as the number of bytes to verify read/write access to. Because the buffer is not null terminated, the __rw_memattr() call could walk past the end of the array looking for a null terminator.
> I believe that the call to __rw_memattr() in _rw_fmtlong() should be getting the actual length of the string that is being formatted so as to avoid reading past the end of the source array. I see no reason to allow __rw_memattr() to go looking for a null terminator when we don't know that there is one there. This same problem occurs in _rw_fmtwstr() and _rw_fmtarray().
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Closed: (STDCXX-581) purify reports uninitialized memory
read in __rw_memattr
Posted by "Farid Zaripov (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/STDCXX-581?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Farid Zaripov closed STDCXX-581.
--------------------------------
> purify reports uninitialized memory read in __rw_memattr
> --------------------------------------------------------
>
> Key: STDCXX-581
> URL: https://issues.apache.org/jira/browse/STDCXX-581
> Project: C++ Standard Library
> Issue Type: Improvement
> Components: Test Driver
> Affects Versions: 4.2.0
> Reporter: Travis Vitek
> Assignee: Travis Vitek
> Fix For: 4.2.1
>
> Attachments: 0.char.log, stdcxx-581.patch
>
>
> __rw_memattr() checks that a specified block of memory is addressable for reading or writing. It takes a pointer and a length. If the length is _RWSTD_SIZE_MAX, then it is assumed that the pointer refers to a null terminated string and the number of bytes is counted via a call to memchr() or strchr(). Unfortunately, sof the formatted io functions in printf.cpp cause __rw_memattr() to unnecessarily touch uninitialized memory or even worse to look for the null terminator in a buffer that is not null terminated.
> An example of this is _rw_fmtlong(). It allocates a buffer of 130 chars and formats a long value into that buffer without null terminating the buffer [it appears that this is intentional]. It then calls _rw_fmtstr() on the result. Internally _rw_fmtstr() calls __rw_memattr() with _RWSTD_SIZE_MAX as the number of bytes to verify read/write access to. Because the buffer is not null terminated, the __rw_memattr() call could walk past the end of the array looking for a null terminator.
> I believe that the call to __rw_memattr() in _rw_fmtlong() should be getting the actual length of the string that is being formatted so as to avoid reading past the end of the source array. I see no reason to allow __rw_memattr() to go looking for a null terminator when we don't know that there is one there. This same problem occurs in _rw_fmtwstr() and _rw_fmtarray().
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (STDCXX-581) purify reports uninitialized memory
read in __rw_memattr
Posted by "Farid Zaripov (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/STDCXX-581?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12536696 ]
Farid Zaripov commented on STDCXX-581:
--------------------------------------
Commited thus: http://svn.apache.org/viewvc?rev=587117&view=rev
> purify reports uninitialized memory read in __rw_memattr
> --------------------------------------------------------
>
> Key: STDCXX-581
> URL: https://issues.apache.org/jira/browse/STDCXX-581
> Project: C++ Standard Library
> Issue Type: Improvement
> Components: Test Driver
> Reporter: Travis Vitek
> Assignee: Travis Vitek
> Fix For: 4.2.1
>
> Attachments: 0.char.log, stdcxx-581.patch
>
>
> __rw_memattr() checks that a specified block of memory is addressable for reading or writing. It takes a pointer and a length. If the length is _RWSTD_SIZE_MAX, then it is assumed that the pointer refers to a null terminated string and the number of bytes is counted via a call to memchr() or strchr(). Unfortunately, sof the formatted io functions in printf.cpp cause __rw_memattr() to unnecessarily touch uninitialized memory or even worse to look for the null terminator in a buffer that is not null terminated.
> An example of this is _rw_fmtlong(). It allocates a buffer of 130 chars and formats a long value into that buffer without null terminating the buffer [it appears that this is intentional]. It then calls _rw_fmtstr() on the result. Internally _rw_fmtstr() calls __rw_memattr() with _RWSTD_SIZE_MAX as the number of bytes to verify read/write access to. Because the buffer is not null terminated, the __rw_memattr() call could walk past the end of the array looking for a null terminator.
> I believe that the call to __rw_memattr() in _rw_fmtlong() should be getting the actual length of the string that is being formatted so as to avoid reading past the end of the source array. I see no reason to allow __rw_memattr() to go looking for a null terminator when we don't know that there is one there. This same problem occurs in _rw_fmtwstr() and _rw_fmtarray().
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.