[Bug libstdc++/66624] New: libstdc++ iostream uninitialized data

[Bug libstdc++/66624] New: libstdc++ iostream uninitialized data

[doko at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66624

            Bug ID: 66624
           Summary: libstdc++ iostream uninitialized data
           Product: gcc
           Version: 5.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: doko at gcc dot gnu.org
  Target Milestone: ---

[forwarded from https://bugs.debian.org/789369]

richard@deodand:~/junk$ cat t.cc
#include <iostream>

int main() {
  std::cout << std::hex;
  return 0;
}
richard@deodand:~/junk$ clang++-3.6 -fsanitize=undefined -O0
-fno-optimize-sibling-calls -fno-omit-frame-pointer -g -o t t.cc
richard@deodand:~/junk$ ./t
/usr/bin/../lib/gcc/i586-linux-gnu/5.1.1/../../../../include/c++/5.1.1/bits/ios_base.h:102:24:
runtime error: load of value 4294967221, which is not a valid value for
type 'std::_Ios_Fmtflags'
/usr/bin/../lib/gcc/i586-linux-gnu/5.1.1/../../../../include/c++/5.1.1/bits/ios_base.h:82:67:
runtime error: load of value 4294967221, which is not a valid value for
type 'std::_Ios_Fmtflags'

As far as I can see the problem here is that ios_base::_M_flags is never
initialized.

[Bug libstdc++/66624] libstdc++ iostream uninitialized data

[doko at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66624

--- Comment #1 from Matthias Klose <doko at gcc dot gnu.org> ---
the runtime warnings are not shown when building with g++-5.

[Bug libstdc++/66624] libstdc++ iostream uninitialized data

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66624

--- Comment #2 from Jonathan Wakely <redi at gcc dot gnu.org> ---
It's initialized by the ios_base constructor in src/c++11/ios.cc

[Bug libstdc++/66624] libstdc++ iostream uninitialized data

[richard+gcc at sfere dot greenend.org.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66624

Richard Kettlewell <richard+gcc at sfere dot greenend.org.uk> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |richard+gcc at sfere dot greenend.
                   |                            |org.uk

--- Comment #3 from Richard Kettlewell <richard+gcc at sfere dot greenend.org.uk> ---
(I'm 'richard@deodand'.)
So this is a bug in Clang (or at least in its -fsanitize implementation) then?

[Bug libstdc++/66624] libstdc++ iostream uninitialized data

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66624

--- Comment #4 from Jonathan Wakely <redi at gcc dot gnu.org> ---
I'm not sure, but I don't yet see how _M_state wouldn't get initialized.

[Bug libstdc++/66624] libstdc++ iostream uninitialized data

[rs2740 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66624

TC <rs2740 at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rs2740 at gmail dot com

--- Comment #5 from TC <rs2740 at gmail dot com> ---
Is this not a dup of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56158?

[Bug libstdc++/66624] libstdc++ iostream uninitialized data

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66624

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |trippels at gcc dot gnu.org
         Resolution|---                         |DUPLICATE

--- Comment #6 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
(In reply to TC from comment #5)
> Is this not a dup of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56158?

Yes.

*** This bug has been marked as a duplicate of bug 56158 ***

[Bug libstdc++/66624] libstdc++ iostream uninitialized data

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66624

--- Comment #7 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
markus@x4 ~ % clang++ -fsanitize=undefined -O0 -g t.cc
markus@x4 ~ % gdb ./a.out
Reading symbols from ./a.out...done.
(gdb) b __ubsan::ScopedReport::~ScopedReport
Breakpoint 1 at 0x41f5c0: file
/home/markus/llvm/projects/compiler-rt/lib/ubsan/ubsan_diag.cc, line 364.
(gdb) run
Starting program: /home/markus/a.out 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/libthread_db.so.1".
/usr/lib64/gcc/x86_64-pc-linux-gnu/5.2.1/include/g++-v5/bits/ios_base.h:102:24:
runtime error: load of value 4294967221, which is not a valid value for type
'std::_Ios_Fmtflags'

Breakpoint 1, __ubsan::ScopedReport::~ScopedReport (this=0x7fffffffdec0,
__in_chrg=<optimized out>) at
/home/markus/llvm/projects/compiler-rt/lib/ubsan/ubsan_diag.cc:364
364     ScopedReport::~ScopedReport() {
(gdb) up
#1  0x0000000000420a5f in handleLoadInvalidValue (Data=<optimized out>,
Val=4294967221, Opts=...) at
/home/markus/llvm/projects/compiler-rt/lib/ubsan/ubsan_handlers.cc:375
375                                        : ErrorType::InvalidEnumLoad);
(gdb) up
#2  0x0000000000422dd3 in __ubsan::__ubsan_handle_load_invalid_value
(Data=<optimized out>, Val=<optimized out>)
    at /home/markus/llvm/projects/compiler-rt/lib/ubsan/ubsan_handlers.cc:385
385       handleLoadInvalidValue(Data, Val, Opts);
(gdb) up
#3  0x0000000000425cad in std::operator&= (__a=@0xf09ec0: 4098, __b=4294967221)
at /usr/lib64/gcc/x86_64-pc-linux-gnu/5.2.1/include/g++-v5/bits/ios_base.h:102
102       { return __a = __a & __b; }
(gdb) up
#4  0x0000000000425a21 in std::ios_base::setf (this=0xf09ea8 <std::cout+8>,
__fmtfl=std::_S_hex, __mask=std::_S_basefield)
    at
/usr/lib64/gcc/x86_64-pc-linux-gnu/5.2.1/include/g++-v5/bits/ios_base.h:660
660           _M_flags &= ~__mask;
(gdb) p __mask
$1 = std::_S_basefield
(gdb)