Bug 1280272

Summary: possible use of uninitialized values (found by address sanitizer at build time)
Product: Red Hat Enterprise Linux 7 Reporter: David Jaša <djasa>
Component: spiceAssignee: Default Assignee for SPICE Bugs <rh-spice-bugs>
Status: CLOSED NOTABUG QA Contact: SPICE QE bug list <spice-qe-bugs>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.2CC: cfergeau, fidencio, fziglio, uril
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-02-17 08:34:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
full build log (including less serious bugs - unused variables and results) none

Description David Jaša 2015-11-11 11:23:55 UTC
Created attachment 1092642 [details]
full build log (including less serious bugs - unused variables and results)

Description of problem:
rebuild of spice-server with address sanitizer enabled yields these errors:
----
glz_encoder_dictionary.c: In function 'glz_dictionary_pre_encode':
glz_encoder_dictionary.c:512:30: warning: 'prev_seg_id' may be used uninitialized in this function [-Wmaybe-uninitialized]
             dict->window.segs[prev_seg_id].next = seg_id;
                              ^
glz_encoder_dictionary.c:488:22: note: 'prev_seg_id' was declared here
     uint32_t seg_id, prev_seg_id;
                      ^
----
red_channel.c: In function 'red_channel_client_wait_pipe_item_sent':
red_channel.c:2382:84: warning: 'end_time' may be used uninitialized in this function [-Wmaybe-uninitialized]
                                                      timeout == -1 ? -1 : end_time - red_now());
                                                                                    ^
----


Version-Release number of selected component (if applicable):
spice-server-0.12.4-15.el7.x86_64
libasan-4.8.5-4.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. grab a spice-server srpm, add these lines to %build section of .spec, rebuild:
# sanitizer, disable -debug pkg
%global optflags %(echo %{optflags} | sed 's/ -g / -ggdb -fno-omit-frame-pointer -fsanitize=address /')
%global __global_ldflags %(echo "%{__global_ldflags} -fsanitize=address -lasan")
%global __strip /bin/true
%global debug_package %{nil}
2.
3.

Actual results:
warnings from Description are emitted

Expected results:
bugs (if any) should be fixed, harmless warnings may deserver some explanation or suppression.

Additional info:

Comment 1 Fabiano Fidêncio 2015-11-11 11:41:27 UTC
(In reply to David Jaša from comment #0)
> Created attachment 1092642 [details]
> full build log (including less serious bugs - unused variables and results)
> 
> Description of problem:
> rebuild of spice-server with address sanitizer enabled yields these errors:
> ----
> glz_encoder_dictionary.c: In function 'glz_dictionary_pre_encode':
> glz_encoder_dictionary.c:512:30: warning: 'prev_seg_id' may be used
> uninitialized in this function [-Wmaybe-uninitialized]
>              dict->window.segs[prev_seg_id].next = seg_id;

Never happens.
This part of the code is just triggered when row != 0 and prev_seg_id is set in the first loop when row == 0.

>                               ^
> glz_encoder_dictionary.c:488:22: note: 'prev_seg_id' was declared here
>      uint32_t seg_id, prev_seg_id;
>                       ^
> ----
> red_channel.c: In function 'red_channel_client_wait_pipe_item_sent':
> red_channel.c:2382:84: warning: 'end_time' may be used uninitialized in this
> function [-Wmaybe-uninitialized]
>                                                       timeout == -1 ? -1 :
> end_time - red_now());
>                                                                             
> ^

Never happens as well.
Christophe has a fix and a really nice commit message about this false-positive: http://cgit.freedesktop.org/spice/spice/commit/?id=1b6ced7ddafd1bc6e490af091427327b05c96b3fg

Comment 2 Uri Lublin 2015-11-11 14:21:51 UTC
I agree with Fabiano these are false positives.

That's
http://cgit.freedesktop.org/spice/spice/commit/?id=1b6ced7ddafd1bc6e490af091427327b05c96b3f

Comment 3 Frediano Ziglio 2016-02-17 08:34:55 UTC
As comments these are false positive.