homepage

This issue tracker has been migrated to GitHub , and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: uninitialized memory read in parsetok()
Type: behavior Stage: test needed
Components: Interpreter Core Versions: Python 2.6
process
Status: closed Resolution: fixed
Dependencies: 3367 Superseder:
Assigned To: Nosy List: ajaksu2, benjamin.peterson, lukemoore, meador.inge, nnorwitz
Priority: normal Keywords:

Created on 2006年09月20日 15:50 by lukemoore, last changed 2022年04月11日 14:56 by admin. This issue is now closed.

Messages (8)
msg29891 - (view) Author: Luke Moore (lukemoore) Date: 2006年09月20日 15:50
When running python2.5 under valgrind and running
 exec ""
valgrind issues the following warning:
==6661== Conditional jump or move depends on
uninitialised value(s)
==6661== at 0x403EAF3: parsetok (parsetok.c:189)
==6661== by 0x40ED673: PyParser_ASTFromString
(pythonrun.c:1354)
==6661== by 0x40EF852: PyRun_StringFlags
(pythonrun.c:1225)
==6661== by 0x40CB7FF: PyEval_EvalFrameEx (ceval.c:4202)
==6661== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==6661== by 0x40CCA74: PyEval_EvalCode (ceval.c:494)
==6661== by 0x40EF3A1: PyRun_InteractiveOneFlags
(pythonrun.c:1264)
==6661== by 0x40EF5A2: PyRun_InteractiveLoopFlags
(pythonrun.c:714)
==6661== by 0x40EF6CA: PyRun_AnyFileExFlags
(pythonrun.c:683)
==6661== by 0x40F930D: Py_Main (main.c:496)
==6661== by 0x8048591: main (in /usr/bin/python2.5)
Valgrind does not give warnings when doing the same
thing with python2.4.3.
After further investigation, it looks like
tok->line_start is uninitialized. Initializing to null
in tok_new() removes the valgrind warning, but I have
no idea if this is the correct fix.
msg29892 - (view) Author: Neal Norwitz (nnorwitz) * (Python committer) Date: 2006年09月20日 17:49
Logged In: YES 
user_id=33168
Thanks for the report.
What is the python code that caused this warning to be
generated? I've run valgrind with the standard tests and
don't recall this error. Without looking at the code, the
proposed fix seems to make sense (though from the name, I
would have guessed that line_start is an int rather than a
pointer).
Also, what system and compiler are you using and how did you
build python?
msg29893 - (view) Author: Luke Moore (lukemoore) Date: 2006年09月20日 18:08
Logged In: YES 
user_id=1437974
Running the python statement
 exec ""
in the interactive shell will trigger the warning for me.
I'm running Debian unstable, and can reproduce the problem
with its RC1 python2.5 package built with gcc 4.1:
Python 2.5c1 (r25c1:51305, Aug 19 2006, 18:23:29)
[GCC 4.1.2 20060814 (prerelease) (Debian 4.1.1-11)] on linux2
I can also reproduce the problem with my own build of the
official 2.5 release with built gcc 4.0:
Python 2.5 (r25:51908, Sep 19 2006, 15:38:29)
[GCC 4.0.4 20060904 (prerelease) (Debian 4.0.3-7)] on linux2
msg29894 - (view) Author: Neal Norwitz (nnorwitz) * (Python committer) Date: 2006年09月21日 04:15
Logged In: YES 
user_id=33168
The proposed fix should be made, but I can't reproduce the
problem. That bugs me. I'm running valgrind 3.2.0, what
version are you running? I tried with gcc 3.3.x on x86 and
gcc 3.4.x and 4.1.1 on amd64. Both are on gentoo.
Have you run the entire regression suite with valgrind? I
did, but given I'm not seeing these problems, I wonder if
there might be issues lurking. 
msg29895 - (view) Author: Luke Moore (lukemoore) Date: 2006年09月21日 16:19
Logged In: YES 
user_id=1437974
For me, the output of 'valgrind --version' is
valgrind-3.2.0-Debian.
I get warnings from some tests when I run the test suite
under valgrind. When I ran the tests, I uncommented the
first block of ###-commented suppressions in
valgrind-python.supp and ran:
 valgrind --tool=memcheck
--suppressions=Misc/valgrind-python.supp --quiet ./python -E
-tt ./Lib/test/regrtest.py -u bsddb,network
(Note that I can reproduce the warning I'm seeing the
valgrind-python.supp suppressions file.)
The test suite warnings I get are:
test_asynchat
==2425== Thread 2:
==2425== Conditional jump or move depends on uninitialised
value(s)
==2425== at 0x415F09C: __pthread_manager (manager.c:128)
==2425== by 0x4291309: clone (clone.S:119)
==2425==
==2425== Syscall param clone(child_tidptr) contains
uninitialised byte(s)
==2425== at 0x42912FC: clone (clone.S:100)
==2425== by 0x4291309: clone (clone.S:119)
test_capi
==2420==
==2420== Thread 1:
==2420== Syscall param write(buf) points to uninitialised
byte(s)
==2420== at 0x415E4AF: pthread_detach (join.c:216)
==2420== by 0x40F6BCA: PyThread_start_new_thread
(thread_pthread.h:197)
==2420== by 0x4E82952: test_thread_state
(_testcapimodule.c:663)
==2420== by 0x407BF6C: PyCFunction_Call (methodobject.c:108)
==2420== by 0x40CBF63: PyEval_EvalFrameEx (ceval.c:3566)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x40CABC8: PyEval_EvalFrameEx (ceval.c:3662)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x40CABC8: PyEval_EvalFrameEx (ceval.c:3662)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x40CABC8: PyEval_EvalFrameEx (ceval.c:3662)
==2420== Address 0xAEB75F74 is on thread 1's stack
test_codecs
==2420==
==2420== Conditional jump or move depends on uninitialised
value(s)
==2420== at 0x40A445F: _PyUnicode_DecodeUnicodeInternal
(unicodeobject.c:2395)
==2420== by 0x410D796: unicode_internal_decode
(_codecsmodule.c:225)
==2420== by 0x407BF6C: PyCFunction_Call (methodobject.c:108)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420== by 0x40C4DCA: PyEval_CallObjectWithKeywords
(ceval.c:3435)
==2420== by 0x40DAEAE: PyCodec_Decode (codecs.c:377)
==2420== by 0x4084FD3: PyString_AsDecodedObject
(stringobject.c:391)
==2420== by 0x4086A92: string_decode (stringobject.c:3260)
==2420== by 0x407BF6C: PyCFunction_Call (methodobject.c:108)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420== by 0x40C98D5: PyEval_EvalFrameEx (ceval.c:3846)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420==
==2420== Conditional jump or move depends on uninitialised
value(s)
==2420== at 0x40A0F30: unicode_resize (unicodeobject.c:188)
==2420== by 0x40A105B: _PyUnicode_New (unicodeobject.c:250)
==2420== by 0x40A43F7: _PyUnicode_DecodeUnicodeInternal
(unicodeobject.c:2383)
==2420== by 0x410D796: unicode_internal_decode
(_codecsmodule.c:225)
==2420== by 0x407BF6C: PyCFunction_Call (methodobject.c:108)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420== by 0x40C4DCA: PyEval_CallObjectWithKeywords
(ceval.c:3435)
==2420== by 0x40DAEAE: PyCodec_Decode (codecs.c:377)
==2420== by 0x4084FD3: PyString_AsDecodedObject
(stringobject.c:391)
==2420== by 0x4086A92: string_decode (stringobject.c:3260)
==2420== by 0x407BF6C: PyCFunction_Call (methodobject.c:108)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420==
==2420== Use of uninitialised value of size 4
==2420== at 0x40A0F32: unicode_resize (unicodeobject.c:188)
==2420== by 0x40A105B: _PyUnicode_New (unicodeobject.c:250)
==2420== by 0x40A43F7: _PyUnicode_DecodeUnicodeInternal
(unicodeobject.c:2383)
==2420== by 0x410D796: unicode_internal_decode
(_codecsmodule.c:225)
==2420== by 0x407BF6C: PyCFunction_Call (methodobject.c:108)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420== by 0x40C4DCA: PyEval_CallObjectWithKeywords
(ceval.c:3435)
==2420== by 0x40DAEAE: PyCodec_Decode (codecs.c:377)
==2420== by 0x4084FD3: PyString_AsDecodedObject
(stringobject.c:391)
==2420== by 0x4086A92: string_decode (stringobject.c:3260)
==2420== by 0x407BF6C: PyCFunction_Call (methodobject.c:108)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
test_codeop
==2420==
==2420== Conditional jump or move depends on uninitialised
value(s)
==2420== at 0x403EAF3: parsetok (parsetok.c:189)
==2420== by 0x40ED673: PyParser_ASTFromString
(pythonrun.c:1354)
==2420== by 0x40ED793: Py_CompileStringFlags
(pythonrun.c:1311)
==2420== by 0x40C043A: builtin_compile (bltinmodule.c:464)
==2420== by 0x407BF6C: PyCFunction_Call (methodobject.c:108)
==2420== by 0x40CBF63: PyEval_EvalFrameEx (ceval.c:3566)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x40CABC8: PyEval_EvalFrameEx (ceval.c:3662)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x40CABC8: PyEval_EvalFrameEx (ceval.c:3662)
test_ctypes
==2420==
==2420== Conditional jump or move depends on uninitialised
value(s)
==2420== at 0x40692E5: PyInt_FromLong (intobject.c:87)
==2420== by 0x6B12F18: l_get (cfield.c:810)
==2420== by 0x6B0FC8A: _CallProc (callproc.c:740)
==2420== by 0x6B0B48D: CFuncPtr_call (_ctypes.c:3357)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420== by 0x40C98D5: PyEval_EvalFrameEx (ceval.c:3846)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x40CABC8: PyEval_EvalFrameEx (ceval.c:3662)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x4067C59: function_call (funcobject.c:517)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420==
==2420== Use of uninitialised value of size 4
==2420== at 0x6B15703: ffi_call (ffi.c:237)
==2420== by 0x6B0FADE: _CallProc (callproc.c:665)
==2420== by 0x6B0B48D: CFuncPtr_call (_ctypes.c:3357)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420== by 0x40C6CB8: PyEval_EvalFrameEx (ceval.c:3777)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x4067C59: function_call (funcobject.c:517)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420== by 0x40C98D5: PyEval_EvalFrameEx (ceval.c:3846)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x4067C59: function_call (funcobject.c:517)
==2420==
==2420== Use of uninitialised value of size 4
==2420== at 0x6B15706: ffi_call (ffi.c:237)
==2420== by 0x6B0FADE: _CallProc (callproc.c:665)
==2420== by 0x6B0B48D: CFuncPtr_call (_ctypes.c:3357)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420== by 0x40C6CB8: PyEval_EvalFrameEx (ceval.c:3777)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x4067C59: function_call (funcobject.c:517)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420== by 0x40C98D5: PyEval_EvalFrameEx (ceval.c:3846)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x4067C59: function_call (funcobject.c:517)
test_gzip
==2420==
==2420== Conditional jump or move depends on uninitialised
value(s)
==2420== at 0x52DC1CA: longest_match (in
/home/luke/dev/hfs/dsolib/libz.so.1.2.3)
==2420== by 0x52DCEB0: deflate_slow (in
/home/luke/dev/hfs/dsolib/libz.so.1.2.3)
==2420== by 0x52DD6BF: deflate (in
/home/luke/dev/hfs/dsolib/libz.so.1.2.3)
==2420== by 0x52D4DE9: PyZlib_flush (zlibmodule.c:605)
==2420== by 0x407BF6C: PyCFunction_Call (methodobject.c:108)
==2420== by 0x40CBF63: PyEval_EvalFrameEx (ceval.c:3566)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x40CABC8: PyEval_EvalFrameEx (ceval.c:3662)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x4067C59: function_call (funcobject.c:517)
==2420==
==2420== Conditional jump or move depends on uninitialised
value(s)
==2420== at 0x52DC153: longest_match (in
/home/luke/dev/hfs/dsolib/libz.so.1.2.3)
==2420== by 0x52DCEB0: deflate_slow (in
/home/luke/dev/hfs/dsolib/libz.so.1.2.3)
==2420== by 0x52DD6BF: deflate (in
/home/luke/dev/hfs/dsolib/libz.so.1.2.3)
==2420== by 0x52D4DE9: PyZlib_flush (zlibmodule.c:605)
==2420== by 0x407BF6C: PyCFunction_Call (methodobject.c:108)
==2420== by 0x40CBF63: PyEval_EvalFrameEx (ceval.c:3566)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x40CABC8: PyEval_EvalFrameEx (ceval.c:3662)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x4067C59: function_call (funcobject.c:517)
==2420==
==2420== Conditional jump or move depends on uninitialised
value(s)
==2420== at 0x52DC18E: longest_match (in
/home/luke/dev/hfs/dsolib/libz.so.1.2.3)
==2420== by 0x52DCEB0: deflate_slow (in
/home/luke/dev/hfs/dsolib/libz.so.1.2.3)
==2420== by 0x52DD6BF: deflate (in
/home/luke/dev/hfs/dsolib/libz.so.1.2.3)
==2420== by 0x52D4DE9: PyZlib_flush (zlibmodule.c:605)
==2420== by 0x407BF6C: PyCFunction_Call (methodobject.c:108)
==2420== by 0x40CBF63: PyEval_EvalFrameEx (ceval.c:3566)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CB1C9: PyEval_EvalFrameEx (ceval.c:3652)
==2420== by 0x40CC8E5: PyEval_EvalCodeEx (ceval.c:2833)
==2420== by 0x4067C59: function_call (funcobject.c:517)
==2420== by 0x4045066: PyObject_Call (abstract.c:1860)
==2420== by 0x40C98D5: PyEval_EvalFrameEx (ceval.c:3846)
msg29896 - (view) Author: Neal Norwitz (nnorwitz) * (Python committer) Date: 2006年09月21日 19:23
Logged In: YES 
user_id=33168
The ones complaining about pthread (test_asynchat,
test_capi) are not a problem. test_codecs is worrisome. I
don't believe test_ctypes is a problem and I'm guessing that
the test_gzip problem is either due to test_ctypes or an
internal gzip library problem. BTW, you might want to read
Misc/README.valgrind if you haven't already. You also need
to skip test_socket_ssl as that causes a bunch of
uninitialized memory warnings due to the SSL library.
Thanks for the reports, I'll try to take a look at them later.
msg84461 - (view) Author: Daniel Diniz (ajaksu2) * (Python triager) Date: 2009年03月30日 02:31
Seems to be the same as issue 3367, but Kristján forgot his repro case
there.
msg98549 - (view) Author: Meador Inge (meador.inge) * (Python committer) Date: 2010年01月30日 04:14
This is the same as 3367, which Benjamin just closed out.
History
Date User Action Args
2022年04月11日 14:56:20adminsetgithub: 43999
2010年01月30日 04:17:40benjamin.petersonsetstatus: open -> closed
resolution: fixed
2010年01月30日 04:14:36meador.ingesetnosy: + benjamin.peterson, meador.inge
messages: + msg98549
2009年03月30日 02:31:51ajaksu2setdependencies: + Uninitialized value read in parsetok.c
type: behavior
versions: + Python 2.6, - Python 2.5
nosy: + ajaksu2

messages: + msg84461
stage: test needed
2006年09月20日 15:50:48lukemoorecreate

AltStyle によって変換されたページ (->オリジナル) /