#249 SuggestMgr::lcs reads from uninitialized memory

v1.0 (example)
closed-invalid
None
5
2014-08-26
2014-05-27
Rachel Blum
No

SuggestMgr::lcs uses malloc twice:

c = (char ) malloc((m + 1) * (n + 1));
b = (char
) malloc((m + 1) * (n + 1));

c is never fully initialized - (m(n+1))...((m+1)(n+1)-1) is not initialized. Furthermore, malloc in this form is susceptible to overflows.

Suggested patch: Replace malloc with calloc. (Patch attached)

1 Attachments

Discussion

  • Németh László

    • status: open --> closed-invalid
    • assigned_to: Németh László
     
  • Rachel Blum

    Rachel Blum - 2014-05-29

    It theoretically should indeed, but it doesn't seem to. There's evidence of uninitialized reads from Chromium's leakchecker - see https://code.google.com/p/chromium/issues/detail?id=377728

    I agree that on inspection the code seems correct.

     
  • Rachel Blum

    Rachel Blum - 2014-05-30

    Follow up: The original code triggers a compiler issue in VS2013SP2 - see the chromium bug link above. The initialization loop - for (i = 1; i <= m; i++) c[i*(n+1)] = 0; - does 0-initialize with a stride of 1 instead of (n+1).

    The patch (update attached) removes the code that triggers the compiler issue.

     

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:





No, thanks