#1315 fexpr~ crash due to uninitialized variable

[mrshpot]

pd: commit 511f4cfd2a0332bbf3a7654102a1518f3eb95bf6 (tag: 0.48-2)
distro: Arch Linux amd64, gcc-8.2.0

Steps to reproduce:

• Run: pd doc/5.reference/expr-help.pd
• Open the fexpr~ example subpatch
• Enable DSP
• Click any 'start' message

or:

• Run: pd doc/5.reference/expr-help.pd
• Open the expr~ example subpatch
• Enable DSP
• Tweak the limiter/clip example slider

Pd dies with abort() in ex_eval:

(gdb) bt
0  0x00007ffff7087b5f in raise () from /usr/lib/libc.so.6
1  0x00007ffff7072452 in abort () from /usr/lib/libc.so.6
2  0x0000555555652d5e in ex_eval () at x_vexp.c:1139
3  0x00005555556541e4 in eval_store () at x_vexp.c:1335
4  0x0000555555648d6b in ex_eval () at x_vexp.c:1174
5  0x000055555566a2b0 in expr_perform () at x_vexp_if.c:451
6  0x000055555559787d in dsp_tick () at d_ugen.c:369
7  0x0000555555603847 in sched_tick () at m_sched.c:422
8  0x00005555556040f5 in m_pollingscheduler () at m_sched.c:517
9  m_mainloop () at m_sched.c:596
10 0x00007ffff7074003 in __libc_start_main () from /usr/lib/libc.so.6
11 0x000055555556a21e in _start ()

Valgrind gives the following warning:

==15650== Conditional jump or move depends on uninitialised value(s)
==15650==    at 0x1FC409: ex_eval (x_vexp.c:1137)
==15650==    by 0x2081E3: eval_store (x_vexp.c:1335)
==15650==    by 0x1FCD6A: ex_eval (x_vexp.c:1174)
==15650==    by 0x21E2AF: expr_perform (x_vexp_if.c:451)
==15650==    by 0x14B87C: dsp_tick (d_ugen.c:369)
==15650==    by 0x1B7846: sched_tick (m_sched.c:422)
==15650==    by 0x1B80F4: m_pollingscheduler (m_sched.c:517)
==15650==    by 0x1B80F4: m_mainloop (m_sched.c:596)
==15650==    by 0x5622002: (below main) (in /usr/lib/libc-2.28.so)
==15650==  Uninitialised value was created by a stack allocation
==15650==    at 0x208080: eval_store (x_vexp.c:1323)

So the story seems to be that:

1) eval_store has an uninitialized struct ex_ex arg; local variable which is passed to ex_eval() in case ET_VAR:
2) ex_eval trips on the optr->ex_type==ET_VEC check in case ET_XI0: or case ET_XI:

If the struct ex_ex arg; variable is initialized, all expr~/fexpr~ examples work.

This fixes the problem for me:

diff --git a/src/x_vexp.c b/src/x_vexp.c
index 0ce43ae..bff93ac 100644
--- a/src/x_vexp.c
+++ b/src/x_vexp.c
@@ -1329,6 +1329,9 @@ eval_store(struct expr *expr, struct ex_ex *eptr, struct ex_ex *optr, int idx)
         int badleft = 0;
         int notable = 0;


+        arg.ex_type = ET_INT;
+        arg.ex_int = 0;
+
         switch (eptr->ex_type) {
         case ET_VAR:
                 var = (char *) eptr->ex_ptr;

[IOhannes m zmölnig]

included the fix in https://github.com/pure-data/pure-data/pull/413