GeezerVison is showing github.com — cpython3:fuzz_builtin_unicode: Use-of-uninitialized-value in maybe_small_long · Issue #102509 · python/cpython
cpython3:fuzz_builtin_unicode: Use-of-uninitialized-value in maybe_small_long #102509Activityterryjreedy commented on Mar 7, 2023 @ammaraskar commented on the report, asking if it has been 'triaged'. There was no response; it appears from text on the report is that it is not monitored by people on the project. The report claims "Issue filed automatically" (without a URL) but I found no evidence searching cpython open/closed issues for 'unicode' or 'uninitialized'. illia-v commented on Mar 8, 2023 ContributorAuthor More actions ammaraskar commented on Mar 8, 2023 Terry when I was asking if it was triaged there I was referring to whether the other core devs who have access to the fuzzer results had taken a look and filed a CPython issue. mdickinson commented on Mar 18, 2023 See comments on the PR; I believe this is a false positive, and can safely be closed. mdickinson commented on Mar 18, 2023 tl;dr: In the case in question, we do retrieve an integer from allocated but uninitialised memory, but we then multiply that integer by zero, so the lack of initialisation has no adverse effect. illia-v commented on Mar 18, 2023 ContributorAuthor More actions mdickinson commented on Mar 19, 2023
but it prevents fuzzing and building --with-memory-sanitizer.
Hmm, that's awkward. Is there no way to annotate to tell the sanitiser that this case has been checked and deemed safe? E.g., something like this: https://clang.llvm.org/docs/SanitizerSpecialCaseList.html
Slowing down a hot path by adding an unnecessary extra step just so that a tool doesn't emit a false positive error doesn't seem like the right solution. illia-v commented on Mar 20, 2023 ContributorAuthor More actions
Hmm, that's awkward. Is there no way to annotate to tell the sanitiser that this case has been checked and deemed safe? E.g., something like this: https://clang.llvm.org/docs/SanitizerSpecialCaseList.html
Yes, ignoring is an option, I mentioned it in my previous comment 🙂
#102838, I checked and it looks to fix python infra/helper.py reproduce cpython3 fuzz_builtin_unicode clusterfuzz-testcase-minimized-fuzz_builtin_unicode-6313066228219904. markshannon commented on Jul 28, 2023 The C spec says that an uninitialized value can include trap values, so in theory multiplying by zero could trap.
That won't happen on any mainstream hardware, but we should probably fix it. Reacted by Gregory P. Smith illia-v commented on Jul 28, 2023 ContributorAuthor More actions illia-v commented on Aug 2, 2023 ContributorAuthor More actions
MetadataMetadataDevelopmentNo branches or pull requestsIssue actions
|