Re: [Valgrind-users] libcrypto/openssl uninitialized memory

[Fred S. <fr...@co...>]

Dan:

Thanks for the links!

I was, in fact, THINKING of the Debian issue, wondering if these
un-initialized things may be stuff that's intentionally left that way as
a source of entropy. I don't mind that, I'm just trying to make sure
there's nothing I'm doing that's causing it.

Fred Smith
Senior Applications Programmer/Analyst
Computrition, Inc.
fr...@co...
781-275-4488x148
 

> -----Original Message-----
> From: dan...@gm... [mailto:dan...@gm...] On
Behalf
> Of Dan Kegel
> Sent: Wednesday, May 28, 2008 3:53 PM
> To: Fred Smith
> Cc: val...@li...
> Subject: Re: [Valgrind-users] libcrypto/openssl uninitialized memory
> 
> On Wed, May 28, 2008 at 11:48 AM, Fred Smith <fr...@co...>
> wrote:
> > I'm working on an app that uses openSSL (and libcrypto), and I find
when
> > running it under valgrind (memcheck) I'm getting huge numbers of
reports
> of
> > use of un-initialized memory. They all appear to be stuff I've not
> > allocated, so I don't think it's anything I'm doing wrong.
> >
> > Just wondering if anyone else here has seen this and can say if it's
OK
> or
> > not. Here's one example (of many):
> >
> > ==29892== Conditional jump or move depends on uninitialised value(s)
> (otag
> > 9339)
> > ==29892==    at 0x14B42B: BN_mod_inverse (in
/lib/libcrypto.so.0.9.7a)
> 
> See http://www.openssl.org/support/faq.html#PROG14 for a tip.
> See http://marc.info/?l=openssl-dev&m=120077437529837&w=2
> for some discussion of this particular error.
> See also the recent kerfluffle, http://wiki.debian.org/SSLkeys for a
> cautionary tale.
> - Dan

This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error please notify the system manager. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email