580472 - Uninitialized memory read in Posix SpyConnectionLoop impl

Status: RESOLVED FIXED

(Tamarin Graveyard :: Garbage Collection (mmGC), defect, P3)

Description

[Edwin Smith]

void* SpyConnectionLoop(void*)
{
    struct sockaddr_un sockAddr;
    socklen_t len = sizeof(sockAddr.sun_family) + strlen(sockAddr.sun_path)+1;
                                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

When the SpyConnectionLoop thread is spawned, the socket is not passed
in and the loop is trying to access an uninitialized sockaddr_un instance.

==20849== Conditional jump or move depends on uninitialised value(s)
==20849==    at 0x3829FB: strlen (mc_replace_strmem.c:282)
==20849==    by 0x5A5A: SpyConnectionLoop(void*) (SpyUtilsPosix.cpp:68)
==20849==    by 0x48D81C: _pthread_start (in /usr/lib/libSystem.B.dylib)
==20849==    by 0x48D6A1: thread_start (in /usr/lib/libSystem.B.dylib)
==20849==  Uninitialised value was created by a stack allocation
==20849==    at 0x5A30: SpyConnectionLoop(void*) (SpyUtilsPosix.cpp:64)

Comment 1

[Tommy Reilly]

Attachment: Fix bad reads

Comment 2

[Lars T Hansen]

Comment on attachment 476002 [details] [diff] [review]
Fix bad reads

'len' is just used the once in the function and could actually be open-coded in the call to accept().

Comment 3

[Tommy Reilly]

seemed weird to open code an in/out parameter, left as is:
http://hg.mozilla.org/tamarin-redux/rev/e21b84e1dea4