Repository navigation
Use of uninitialized memory in Objects/longobject.c #106914
Description
Activity
Duplicate of #102509?
I believe Greg was working on getting us to a point where we could have a MSan buildbot (#79395), although I don't know what the state of that is now.
I started down that path at one point in 2018-19ish... but found MSAN so painful to setup as it really doesn't work well in an environment where you haven't compiled the entire system (all transitive dependency dynamically linked libraries) with MSAN. Without that it relied on an MSAN baked in exclusion list of known "misbehaviors" from various libraries otherwise and that list vs actual implementation was never sufficient for results I'd want to surface in front of people. We should revisit this at some point, maybe the feasibility has changed? (internally at work where we build our entire stack, MSAN works pretty well, because a team exists to keep it relevant)
Regardless, this may well be a dup as Alex pointed out (thanks!). Investigation required; there's some interesting discussion over there.
Reacted by Alex WaygoodDuplicate of #102509?
Yes, closing.
When using MemorySanitizer, maybe_small_long() in Objects/longobject.c is flagged as using uninitialized memory when passed certain values, which means Python main, 312 and 3.11 can't even be built correctly with --with-memorysanitizer:
The source of the problem is
_PyLong_CompactValue(from Include/cpython/longintrepr.h) multiplying ob_digit[0] by size, where ob_digit[0] may be uninitialized when size is 0 (the simplest reproducer for that isint('0')). (In Python 3.11 this same logic happens in medium_value() in longobject.c instead. Python 3.10 had similar logic in the MEDIUJM_VALUE macro in longobject.c, but it had an explicit check for size being 0.)(I believe, but I'm not entirely sure, the code relies on undefined behaviour, which we should avoid -- although it's only undefined for very esoteric reasons. Even so, the simple solution is to add back the check for sign being 0. If that really has a noticeable impact, we could add the branch only when using MemorySanitizer.)
I believe Greg was working on getting us to a point where we could have a MSan buildbot (#79395), although I don't know what the state of that is now.