[Bug c/37001] New: Uninitialized static variables on x86_64

[Bug c/37001] New: Uninitialized static variables on x86_64

[gerald at wireshark dot org]

Wireshark's Buildbot system recently uncovered what appears to be a bug in gcc.
The following code:

    static guint                tap_current=0;
    [ ... ]
    fprintf(stderr, "dissect_bssmap tap_current: %u\n", tap_current);

produces the following output:

dissect_bssmap tap_current: 2801996644

'gcc -v' output:
Using built-in specs.
Target: x86_64-linux-gnu
Configured with: ../src/configure -v
--enable-languages=c,c++,fortran,objc,obj-c++,treelang --prefix=/usr
--enable-shared --with-system-zlib --libexecdir=/usr/lib
--without-included-gettext --enable-threads=posix --enable-nls
--with-gxx-include-dir=/usr/include/c++/4.1.3 --program-suffix=-4.1
--enable-__cxa_atexit --enable-clocale=gnu --enable-libstdcxx-debug
--enable-mpfr --enable-checking=release x86_64-linux-gnu
Thread model: posix
gcc version 4.1.3 20070929 (prerelease) (Ubuntu 4.1.2-16ubuntu2)

(I realize this may be an Ubuntu-specific bug. Launchpad.net pointed me here.)

Steps to reproduce:

  Download a recent Wireshark tarball from 
  http://www.wireshark.org/download/automated/src/ or check out from SVN at
  http://anonsvn.wireshark.org/wireshark/trunk/

  Apply the patch which I'll attach shortly and build Wireshark

  Download the capture file from
 
http://www.wireshark.org/download/automated/captures/fuzz-2008-07-31-3587.pcap

  Run './tshark -nVr /tmp/fuzz-2008-07-31-3587.pcap > /dev/null 2> /tmp/tp.out
; head -10 /tmp/tp.out'

You should see something like the following:

dissect_bssmap tap_current: 2801996644
dissect_bssmap tap_current: 0
dissect_bssmap tap_current: 1
dissect_dtap tap_current: 2801996612
dissect_bssmap tap_current: 2
dissect_dtap tap_current: 0
dissect_bssmap tap_current: 3
dissect_dtap tap_current: 1
dissect_bssmap tap_current: 0
dissect_bssmap tap_current: 1

Sorry I don't have a smaller test case.


-- 
           Summary: Uninitialized static variables on x86_64
           Product: gcc
           Version: 4.1.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: gerald at wireshark dot org
 GCC build triplet: x86_64-linux-gnu
  GCC host triplet: x86_64-linux-gnu
GCC target triplet: x86_64-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37001

[Bug c/37001] Uninitialized static variables on x86_64

[gerald at wireshark dot org]

------- Comment #1 from gerald at wireshark dot org  2008-08-01 16:31 -------
Created an attachment (id=15993)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=15993&action=view)
Add debugging printfs to epan/dissectors/packet-gsm_a.c


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37001

[Bug c/37001] Uninitialized static variables on x86_64

[rguenth at gcc dot gnu dot org]

------- Comment #2 from rguenth at gcc dot gnu dot org  2008-08-01 17:23 -------
GCC 4.1 is no longer maintained, please try a newer version and provide a
smaller testcase (we are _not_ downloading software and debugging it - this
is the obligation of the application developer).


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37001

[Bug c/37001] Uninitialized static variables on x86_64

[rguenth at gcc dot gnu dot org]

------- Comment #3 from rguenth at gcc dot gnu dot org  2008-08-01 17:24 -------
Just as a hint - as this is a static symbol you may want to use a gdb
watchpoint to see what changes it.  Just do

gdb> watch tap_current


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37001

[Bug c/37001] Uninitialized static variables on x86_64

[gerald at wireshark dot org]

------- Comment #4 from gerald at wireshark dot org  2008-08-01 19:05 -------
I am "the application developer" and I've done my job. I'm asking you why gcc
isn't setting a variable to 0 when we've explicitly told it to do so.

Watching tap_current gives me the following:
GNU gdb 6.6-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu"...
Using host libthread_db library "/lib/libthread_db.so.1".
(gdb) break dissect_bssmap
Function "dissect_bssmap" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y

Breakpoint 1 (dissect_bssmap) pending.
(gdb) run -nVr /tmp/fuzz-2008-07-31-3587.pcap > /dev/null
Starting program: /home/gerald/devel/wireshark/.libs/lt-tshark -nVr
/tmp/fuzz-2008-07-31-3587.pcap > /dev/null
[Thread debugging using libthread_db enabled]
[New Thread 47286662778672 (LWP 10314)]
Breakpoint 2 at 0x2b01c4b4b7a0: file packet-gsm_a.c, line 20279.
Pending breakpoint "dissect_bssmap" resolved
[Switching to Thread 47286662778672 (LWP 10314)]

Breakpoint 2, dissect_bssmap (tvb=0x125bc60, pinfo=0x125a0a0, tree=0x125af40)
    at packet-gsm_a.c:20279
20279   {
(gdb) watch tap_current
Hardware watchpoint 3: tap_current
(gdb) c
Continuing.
dissect_bssmap tap_current: 3323523940
Hardware watchpoint 3: tap_current

Old value = 3323523940
New value = 3323523941
dissect_bssmap (tvb=0x125bc60, pinfo=0x125a0a0, tree=0x125af40)
    at packet-gsm_a.c:20315
20315       tap_p = &tap_rec[tap_current];
(gdb)

Shouldn't it be

Old value = 0
New value = 1

instead?

At any rate, I've checked in a workaround in the Wireshark SVN repository and
opened a bug for this issue at Launchpad.net.
http://anonsvn.wireshark.org/viewvc/index.py?view=rev&revision=25886
https://bugs.launchpad.net/ubuntu/+source/gcc-4.1/+bug/254025

As I mentioned in the initial report, trying to report a gcc bug at
Launchpad.net points me to the gcc Bugzilla. If this isn't the correct path to
follow, maybe you should tell them to stop doing that.

Thank you for your time.


-- 

gerald at wireshark dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |WONTFIX


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37001

[Bug c/37001] Uninitialized static variables on x86_64

[rguenth at gcc dot gnu dot org]

------- Comment #5 from rguenth at gcc dot gnu dot org  2008-08-01 20:15 -------
Well, that only hints at that the bss section is not cleared properly which
is the job of the kernel and/or the dynamic linker.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37001