Bug 150149 - local variable used before set
Summary: local variable used before set
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Fedora
Classification: Fedora
Component: jasper
Version: 3
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Rex Dieter
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-03-02 22:10 UTC by David Binderman
Modified: 2007-11-30 22:11 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2005-06-24 13:28:53 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
init tmpval before first use (334 bytes, patch)
2005-06-24 13:17 UTC, Rex Dieter
no flags Details | Diff

Description David Binderman 2005-03-02 22:10:40 UTC
Description of problem:

I just tried to compile package jasper-1.701.0-3 from 
Redhat Fedora Extras development tree.

The Intel compiler said

pnm_enc.c(431): remark #592: variable "tmpval" is used before its
value is set

The source code is

        uint_fast32_t tmpval;
        int c;

        n = (wordsize + 7) / 8;
        tmpval &= PNM_ONES(8 * n);

Suggest init tmpval before first use.



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Rex Dieter 2005-06-22 16:47:16 UTC
Update to kile-1.8.1 coming soon... See bug #161343

Comment 2 David Binderman 2005-06-23 09:27:08 UTC
>Update to kile-1.8.1 coming soon

Good, but does an upgrade guarantee that a bug is fixed ?

It might be a wise idea to have a look at the new version
to check that the bug is fixed.


Comment 3 Michael Schwendt 2005-06-24 11:21:32 UTC
Yeah, right. Please either 

 * do care and fix the bug/forward it upstream + close this as UPSTREAM

or 

 * don't care and leave it open.

Comment 4 Rex Dieter 2005-06-24 13:04:10 UTC
Looks like I closed the wrong bug.  Reopening...

Comment 5 Rex Dieter 2005-06-24 13:17:46 UTC
Created attachment 115931 [details]
init tmpval before first use

Attempt 1 at patch.

Comment 6 Rex Dieter 2005-06-24 13:28:53 UTC
Sent Upstream: http://groups.yahoo.com/group/jasper-discussion/message/891


Comment 7 Michael Schwendt 2005-06-24 14:04:56 UTC
Watching the diff outside its full context, it looks highly questionable. "zero
AND something" remains zero.


Comment 8 Rex Dieter 2005-06-24 14:15:23 UTC
Good point, however, "Undefined value AND something" is even scarier, don't you
think?  (-:

Comment 9 Rex Dieter 2005-06-24 14:16:51 UTC
I'm starting to think this is a geniune coding error and
tmpval &= PNM_ONES(8 * n);
was probably meant to be (something like)
tmpval = PNM_ONES(8 * n);

Comment 10 Michael Schwendt 2005-06-24 15:36:25 UTC
And even then, the next line would overwrite tmpval completely:

    tmpval = (*val) << (8 * (4 - n));

I think it's a thinko. It's WORKSFORME for us, but upstream should have interest
in cleaning up this code. Based on the function name (put an unsigned integer
into a stream) and what the code does (store the uint bytewise, most-significant
byte first), the criticised line does nothing useful. Let's see:

static int pnm_putuint(jas_stream_t *out, int wordsize, uint_fast32_t *val)
{
	int n;
	uint_fast32_t tmpval;
	int c;

	n = (wordsize + 7) / 8;
	tmpval &= PNM_ONES(8 * n);
	tmpval = (*val) << (8 * (4 - n));
	while (--n >= 0) {
		c = (tmpval >> 24) & 0xff;
		if (jas_stream_putc(out, c) == EOF) {
			return -1;
		}
		tmpval = (tmpval << 8) & 0xffffffff;
	}
	return 0;
}

Example: wordsize=8 => n=8+7/8=15/8=1 => it shifts val 24 bits to the left into
tmpval, so the loop stores bits 31-24 (the 8 bit wordsize) into the stream and
is done.

The PNM_ONES macro fills at most 32 bits with ones. When dealing with signed (!)
integers, one could use it for a mask, which extends the sign-bit into the
upper-most bits of a word. E.g. store 4-bit 0xe (-2) as 8-bit 0xfe. However,
this code does nothing like that since it overwrites tmpval with the full 32-bit
*val as the last step before writing the individual bytes into the stream. With
the shift to the left, the lower bits of tmpval are zeroed out.



Note You need to log in before you can comment on or make changes to this bug.