[Valgrind-users] Extending memcheck's validity bit propagation

[Patrick J. L. <lop...@gm...>]

Right now, if I have code like this:

  int a; /* invalid value */
  int b = a + 1; /* operation on invalid value */

...memcheck does not produce a warning for the addition. It just taints b
as invalid and only generates a warning if I try to use b in a
behavior-changing way. This is good, and it is exactly what I want.

However, if instead I have this code:

  int a; /* invalid value */
  int b;
  if (a > 0) /* conditional on invalid value */
    b = a;
  else
    b = 0;

...memcheck produces a warning on the conditional branch. But if you look
at what this code actually computes, it is just "b = max(a,0)", which is
not so different from "b = a + 1". (That is, b is just some simple function
of a.) I want to teach memcheck to treat this second example like the
first; that is, just taint b as invalid if a is invalid.

Another example:

  extern unsigned char lookup[256]; // assume this is initialized

  unsigned char x;
  unsigned char y = lookup[x];

Here, I have some 8-bit function implemented using a lookup table. Again,
memcheck issues a diagnostic for using x as part of computing an address.
But I want to think of y as a simple function of x, and tell memcheck to
just let y inherit x's invalidity.

I believe I can cobble together what I want from VALGRIND_GET_VBITS() and
VALGRIND_SET_VBITS(). But I have two questions.

1) Is this the right way to do this, or is there some other mechanism more
suitable for this purpose?
2) If I do use SET/GET_VBITS(), how can I arrange for --track-origins=yes
to work if there is a later use of the uninitialized data?

Thanks.

 - Pat