1837617 - Uninitialized memory while handling slot structures

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Jakub Jelen]

Attachment: proposed patch

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/114.0

Steps to reproduce:

Running libcacard tests under valgrind:

https://gitlab.freedesktop.org/spice/libcacard/-/issues/15

This points to the use of flagSeries and flagState members, which are not initialized during the structure initialization and first tested in secmod_HandleWaitForSlotEvent (and value is assigned to them only after the first test). I believe the correct fix is to make sure they are initialized when the structure is allocated otherwise it might cause unexpected behavior.

This is available in the master.

Actual results:

valgrind reports memory issues pointing to NSS:

==44832== Thread 3:
==44832== Conditional jump or move depends on uninitialised value(s)
==44832==    at 0x4AC98A7: secmod_HandleWaitForSlotEvent (pk11util.c:1181)
==44832==    by 0x4AC9BCD: SECMOD_WaitForAnyTokenEvent (pk11util.c:1252)
==44832==    by 0x4860DFE: vcard_emul_event_thread (vcard_emul_nss.c:830)
==44832==    by 0x4C04758: _pt_root (ptthread.c:201)
==44832==    by 0x4CB5906: start_thread (pthread_create.c:444)
==44832==    by 0x4D3B773: clone (clone.S:100)
==44832== 

Expected results:

NSS should not use uninitialized memory

Comment 1

[fkrenzel]

Attachment: Bug 1837617: Initialize flags in slot structures r=#nss-reviewers

These flags are not set to initial value when the structure is allocated
and first tested in pk11util.c before they are assigned, causing
conditional jump depending on uninitialized values when invoked under
valgrind, like this:

==44832== Conditional jump or move depends on uninitialised value(s)
==44832== at 0x4AC98A7: secmod_HandleWaitForSlotEvent (pk11util.c:1181)
[...]

Signed-off-by: Jakub Jelen <[e-mail]>

Comment 2

[Jakub Jelen]

The patch was merged in last week already https://phabricator.services.mozilla.com/D180434 closing the bug.

Comment 3

[Dana Keeler (she/her) [:keeler]]

https://hg.mozilla.org/projects/nss/rev/be670383f98cf577865f0d09bd2dfbdba84f3703
This landed in 3.91, but we don't have the flags in bugzilla for that yet.