[Bug fortran/31922] New: Accessing uninitialized variable for print *, trim(blank_string)

[Bug fortran/31922] New: Accessing uninitialized variable for print *, trim(blank_string)

[burnus at gcc dot gnu dot org]

program x
  implicit none
  character(20) :: ch
  ch = ' '
  print '(a)', trim(ch)
end program x

valgrind:
==23260== Conditional jump or move depends on uninitialised value(s)
==23260==    at 0x4EBD506: formatted_transfer_scalar (transfer.c:888)
==23260==    by 0x4EBDFCC: formatted_transfer (transfer.c:1362)
==23260==    by 0x4009CE: MAIN__ (in /dev/shm/a.out)
==23260==    by 0x400A1B: main (fmain.c:22)


-- 
           Summary: Accessing uninitialized variable for print *,
                    trim(blank_string)
           Product: gcc
           Version: 4.3.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: fortran
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: burnus at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=31922

[Bug fortran/31922] Accessing uninitialized variable for print *, trim(blank_string)

[burnus at gcc dot gnu dot org]

------- Comment #1 from burnus at gcc dot gnu dot org  2007-05-14 20:24 -------
Jerry, you are one of the libgfortran/IO experts, could you have a look?


  _gfortran_transfer_character (&dt_parm.0, pstr.1, len.2);

uses uninitialized memory if len = 0 and p = NULL. This happens because
empty_string is not initialized to anything and points to a random position.
However, it is later tested for "p == NULL".


transfer_character (st_parameter_dt *dtp, void *p, int len)
{
  static char *empty_string[0];
[..]
  if (len == 0 && p == NULL)
    p = empty_string;
  dtp->u.p.transfer (dtp, BT_CHARACTER, p, len, len, 1);

And in:

formatted_transfer_scalar (st_parameter_dt *dtp, bt type, void *p, int len,
  n = (p == NULL) ? 0 : ((type != BT_COMPLEX) ? 1 : 2);

Would be the following a correctly working alternative?
  static char empty_string[0];
  if (len == 0 && p == NULL)
    p = &empty_string;


-- 

burnus at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jvdelisle at gcc dot gnu dot
                   |                            |org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=31922

[Bug fortran/31922] Accessing uninitialized variable for print *, trim(blank_string)

[jvdelisle at gcc dot gnu dot org]

------- Comment #2 from jvdelisle at gcc dot gnu dot org  2007-05-15 03:38 -------
I think the correct place to fix this is in trim.  The uninitialized variable
is being passed to the library from trim.  Looking at the fdump-tree-original,
you can see that the variable ch is initialized by setting to all blanks.  Then
a temporary char pointer is set up to pass to trim which is called with a
temporary len which is set by trim to zero when it scans through the string of
blanks.

This patch fixes this.

Index: string_intrinsics.c
===================================================================
*** string_intrinsics.c (revision 124646)
--- string_intrinsics.c (working copy)
*************** string_trim (GFC_INTEGER_4 * len, void *
*** 171,176 ****
--- 171,178 ----
        /* copy string if necessary.  */
        memmove (*dest, src, *len);
      }
+   else
+     *dest = NULL;
  }

With this patch, valgrind gives a clean report and it regression tested fine. 
I also checked the result of the same operation to a file.

I will commit this to trunk as simple and obvious if you agree.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=31922

[Bug fortran/31922] Accessing uninitialized variable for print *, trim(blank_string)

[burnus at gcc dot gnu dot org]

------- Comment #3 from burnus at gcc dot gnu dot org  2007-05-15 08:52 -------
> This patch fixes this.
> +   else
> +     *dest = NULL;

This patch fixes the actual problem and should be committed. Thanks Jerry.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=31922

[Bug fortran/31922] Accessing uninitialized variable for print *, trim(blank_string)

[jvdelisle at gcc dot gnu dot org]

------- Comment #4 from jvdelisle at gcc dot gnu dot org  2007-05-16 01:38 -------
Subject: Bug 31922

Author: jvdelisle
Date: Wed May 16 00:37:55 2007
New Revision: 124754

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=124754
Log:
2007-05-15  Jerry DeLisle  <jvdelisle@gcc.gnu.org>

        PR libfortran/31922
        * intrinsics/string_intrinsics.c (string_trim): Set result to null if
        string length is zero.

Modified:
    trunk/libgfortran/ChangeLog
    trunk/libgfortran/intrinsics/string_intrinsics.c


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=31922

[Bug fortran/31922] [4.2 only] Accessing uninitialized variable for print *, trim(blank_string)

[jvdelisle at gcc dot gnu dot org]

------- Comment #5 from jvdelisle at gcc dot gnu dot org  2007-05-16 01:39 -------
Fixed on trunk


-- 

jvdelisle at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |jvdelisle at gcc dot gnu dot
                   |dot org                     |org
             Status|UNCONFIRMED                 |ASSIGNED
     Ever Confirmed|0                           |1
   Last reconfirmed|0000-00-00 00:00:00         |2007-05-16 01:39:55
               date|                            |
            Summary|Accessing uninitialized     |[4.2 only] Accessing
                   |variable for print *,       |uninitialized variable for
                   |trim(blank_string)          |print *, trim(blank_string)
   Target Milestone|---                         |4.2.1


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=31922

[Bug fortran/31922] [4.2 only] Accessing uninitialized variable for print *, trim(blank_string)

[jvdelisle at gcc dot gnu dot org]

------- Comment #6 from jvdelisle at gcc dot gnu dot org  2007-05-21 00:00 -------
This is not a regression from previous releases. Closing.


-- 

jvdelisle at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=31922