Skip to content

zend: fix msan #15760

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

zend: fix msan #15760

wants to merge 1 commit into from

Conversation

zeriyoshi
Copy link
Contributor

The code in the master branch triggers warnings with Clang's MemorySanitizer (version 18 or newer).
There are instances where uninitialized values are being compared in if statements.

]# php -v
==114==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0xaaaac6ceafc0 in zend_call_stack_get_linux_proc_maps /php-src/Zend/zend_call_stack.c:227:30
    #1 0xaaaac6cea5a4 in zend_call_stack_get_linux /php-src/Zend/zend_call_stack.c:268:10
    #2 0xaaaac6ce9b28 in zend_call_stack_get /php-src/Zend/zend_call_stack.c:796:6
    #3 0xaaaac6ce91d0 in zend_call_stack_init /php-src/Zend/zend_call_stack.c:84:7
    #4 0xaaaac7ac845c in zend_post_startup /php-src/Zend/zend.c:1135:2
    #5 0xaaaac64f3904 in php_module_startup /php-src/main/main.c:2324:6
    #6 0xaaaac7aece04 in php_cli_startup /php-src/sapi/cli/php_cli.c:397:9
    #7 0xaaaac7ae502c in main /php-src/sapi/cli/php_cli.c:1276:6
    #8 0xffffa32e2298  (/lib/aarch64-linux-gnu/libc.so.6+0x22298) (BuildId: 59a6cf3f027666659833681bc2039e9781f3c188)
    #9 0xffffa32e236c in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x2236c) (BuildId: 59a6cf3f027666659833681bc2039e9781f3c188)
    #10 0xaaaac3eb8d2c in _start (/usr/local/bin/php+0x138d2c) (BuildId: 91d91469db462fc0d04b60823916bcb08195ccf3)

  Uninitialized value was created by an allocation of 'start' in the stack frame
    #0 0xaaaac6ceac0c in zend_call_stack_get_linux_proc_maps /php-src/Zend/zend_call_stack.c:186:2

SUMMARY: MemorySanitizer: use-of-uninitialized-value /php-src/Zend/zend_call_stack.c:227:30 in zend_call_stack_get_linux_proc_maps
Exiting

@iluuu1994
Copy link
Member

That sounds like an MSAN bug... The fix looks harmless though.

@zeriyoshi
Copy link
Contributor Author

I read the code, but isn't the following being processed?
I thought it was common for this to be warned, but I may be misunderstanding...

$ cat test.c
#include <stdint.h>
#include <stdio.h>

int main() {
	uintptr_t ptr;
	if (ptr > 0) {
		printf("%s\n", "hi");
	}
	return 0;
}
$ clang -fsanitize=memory test.c -o test
$ ./test
==4087==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0xaaaab768a410 in main (/test+0xaa410) (BuildId: 17c77b25a498a82e6f0a2cafc268fe60725d8673)
    #1 0xffffb8172298  (/lib/aarch64-linux-gnu/libc.so.6+0x22298) (BuildId: 59a6cf3f027666659833681bc2039e9781f3c188)
    #2 0xffffb817236c in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x2236c) (BuildId: 59a6cf3f027666659833681bc2039e9781f3c188)
    #3 0xaaaab76011ec in _start (/test+0x211ec) (BuildId: 17c77b25a498a82e6f0a2cafc268fe60725d8673)

SUMMARY: MemorySanitizer: use-of-uninitialized-value (/test+0xaa410) (BuildId: 17c77b25a498a82e6f0a2cafc268fe60725d8673) in main
Exiting

@iluuu1994
Copy link
Member

In that case, yes. But in the case you're fixing, start is only accessed when sscanf returns 2, in which case it is initialized. Most likely, MSAN doesn't intercept sscanf to mark these variables as initialized.

@zeriyoshi
Copy link
Contributor Author

I understand! You're correct.
This modification is harmless, but unnecessary.

P.S. Are there any recommended versions of clang that are suitable for use? I frequently encounter false positives, and if these correction PRs are becoming noise, I'd like to stop submitting them.

@thehdsports

This comment was marked as spam.

@zeriyoshi
Copy link
Contributor Author

This was due to my test environment not being properly configured. sorry!

hint: For Debian, always use the packages from apt.llvm.org.
https://apt.llvm.org/

We're continuing this conversation over here

#15759

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants