MemorySanitizer, use of uninitialized in slide_hash zlib/deflate.c:219:20 #518
Comments
|
As noted in the comment immediately below line 219 of deflate.c, "If n is not on any hash chain, prev[n] is garbage but its value will never be used." The sliding of those uninitialized values do not affect the output of deflate. |
|
Do you have any interest in making zlib compatible with MemorySanitizer or should I consider it a bad idea to fuzz zlib with msan? |
…ised memory
slide_hash knowingly reads (possibly) uninitialised memory, see comment
lower down about prev[n] potentially being garbage. In this case, the
result is never used - so we don't care about MSAN complaining about
this read.
By adding the no_sanitize("memory") attribute, clients of zlib won't
see this (unnecessary) error when building and running with
MemorySanitizer. An alternative approach is for clients to build zlib
with -fsanitize-ignorelist=... where the ignorelist contains something
like 'fun:slide_hash'. But that's more work and needs to be redone
for any and all CI systems running a given project with MSAN. Adding
this annotation to zlib's sources is overall more convenient - but
also won't affect non-MSAN builds.
This specific issue was found while running git's test suite, but has
also been reported by other clients, see e.g. madler#518.
|
@madler, could you consider a code update which uses full memory initialisation when zlib is build for fuzzing? In that case performance is not an issue because code which is instrumented for fuzzing is slow anyway. I found this issue because of this fuzzing bug report: https://oss-fuzz.com/testcase-detail/5084378994180096 As you can see other projects use zlib (not surprising) and get error reports which cost time to analyze and comment. |
|
There are a few functions such as |
#517
While fuzzing, uninitialized memory allocated in zcalloc is eventually used in:
| #0 0x53443d in slide_hash zlib/deflate.c:219:20
| #1 0x52b179 in fill_window zlib/deflate.c:1516:13
| #2 0x53b4d0 in deflate_fast zlib/deflate.c:1838:13
| #3 0x531e70 in deflate zlib/deflate.c:1003:18
Version of zlib is 1.2.11 compiled with proper -fsanitize=memory flags on x64 Linux. I can provide more info if needed, including reproducing code.
The text was updated successfully, but these errors were encountered: