This is sources Bugzilla
Bugzilla Version 2.17.5
Bugzilla Bug 2827
  purify reports UMRs (uninitialized memory reads) in readdir() Last modified: 2006-08-12 21:09:08
     Query page      Enter new bug
Bug#: 2827   Hardware:   Reporter: Stefan Wengi <stefan.wengi@adnovum.ch>
Host: Target: Build:
Product:     Add CC:
Component:   Version:   CC:
Remove selected CCs
Status: RESOLVED   Priority:  
Resolution: INVALID   Severity:  
Assigned To: Ulrich Drepper <drepper@redhat.com>   Target Milestone:  
Flags: Requestee:
  backport ()
  examined ()
  testsuite ()
Summary:
Keywords:

Attachment Description Type Created Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 2827 depends on: Show dependency tree
Show dependency graph
Bug 2827 blocks:

Additional Comments:


Leave as RESOLVED INVALID
Reopen bug
Mark bug as VERIFIED

View Bug Activity   |   Format For Printing


Description:   Last confirmed: 0000-00-00 00:00 Opened: 2006-06-23 14:00
running the attached program on Linux (SuSE 9.2) results in purify UMR reports
as shown below.

I checked the sources for glibc 2.4 and it looks like in sysdeps/unix/opendir.c
the function __alloc_dir has some mismatch in malloc() and memset:

  DIR *dirp = (DIR *) malloc (sizeof (DIR) + allocation + pad);

.....

  memset (dirp, '\0', sizeof (DIR));


-------------------------------------------------------------
#include <sys/types.h>
#include <dirent.h>

#include <stdio.h>


int main(int argc, char** argv)
{
	DIR* d;
	struct dirent* e;

	d = opendir(".");
	if (d != NULL) {
		e = readdir(d);
		while (e != NULL) {
			printf("%s\n", e->d_name);
			e = readdir(d);
		}

		closedir(d);
	}
}

-------------------------------------------------------------

****  Purify instrumented ./a.out (pid 30822)  ****
UMR: Uninitialized memory read (311 times):
  * This is occurring while in:
        __getdents     [libc.so.6]
        readdir        [libc.so.6]
        main           [readdir.c:14]
        __libc_start_main [libc.so.6]
        _start         [crt1.o]
  * Reading 2 bytes from 0x80b405c in the heap.
  * Address 0x80b405c is 36 bytes into a malloc'd block at 0x80b4038 of 32796 bytes.
  * This block was allocated from:
        malloc         [rtlib.o]
        opendir        [libc.so.6]
        main           [readdir.c:12]
        __libc_start_main [libc.so.6]
        _start         [crt1.o]

------- Additional Comment #1 From Ulrich Drepper 2006-08-12 21:09 -------
The remainder of the buffer need not be initialized because it is just to store
the results of the getdents call and isn't read before the kernel fills it.

     Query page      Enter new bug
Actions: New | Query | bug # | Reports | Requests   New Account | Log In