Without this patch, the MH test suite would fail when building with glibc 2.26, with 'ali' segfaulting like this: Core was generated by `/tmp/guix-build-mailutils-3.4.drv-0/mailutils-3.4/mh/.libs/ali -a ./Mail/mh_ali'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f8eac263a14 in hash ( name=0x72642e342e332d73 , hash_num=0) at assoc.c:102 102 for (i = 0; *name; name++) (gdb) bt #0 0x00007f8eac263a14 in hash ( name=0x72642e342e332d73 , hash_num=0) at assoc.c:102 #1 0x00007f8eac263e6b in assoc_find_slot (assoc=0xaa59e0, name=0x72642e342e332d73 , install=0x0, slot=0x7ffcddcbf2b8) at assoc.c:219 #2 0x00007f8eac264124 in mu_assoc_lookup (assoc=0xaa59e0, name=0x72642e342e332d73 , dataptr=0x7ffcddcbf2e0) at assoc.c:308 #3 0x00007f8eac29e8ac in mu_ident_deref ( name=0x72642e342e332d73 ) at ident.c:98 #4 0x00007f8eac29f8a6 in mu_locus_point_deinit (pt=0xaa5718) at locus.c:48 #5 0x00007f8eac29fa1b in mu_locus_range_deinit (lr=0xaa5718) at locus.c:99 #6 0x00007f8eac29f9db in mu_locus_range_copy (dest=0xaa5718, src=0x622be0 ) at locus.c:89 #7 0x0000000000408a2a in push_source (name=0xaa74bc "mh_aliases2", fail=1) at mh_alias_lex.l:170 commit b330af9008e4c9168b379867b854f5900a539ad7 Author: Sergey Poznyakoff Date: Sat Nov 18 10:15:48 2017 +0200 Fix the use of uninitialized memory * mh/mh_alias_lex.l (push_source): Initialize locus range prior to copying to it. * libmailutils/cfg/parser.y (mu_cfg_tree_create_node): Likewise. * libmu_sieve/util.c: (mu_sieve_value_create): Likewise. diff --git a/libmailutils/cfg/parser.y b/libmailutils/cfg/parser.y index 4503c7781..3436b8d90 100644 --- a/libmailutils/cfg/parser.y +++ b/libmailutils/cfg/parser.y @@ -1134,10 +1134,9 @@ mu_cfg_tree_create_node (struct mu_cfg_tree *tree, np = mu_alloc (size); np->type = type; + mu_locus_range_init (&np->locus); if (loc) mu_locus_range_copy (&np->locus, loc); - else - memset (&np->locus, 0, sizeof np->locus); p = (char*) (np + 1); np->tag = p; strcpy (p, tag); diff --git a/libmu_sieve/sieve-lex.l b/libmu_sieve/sieve-lex.l index fd145bfe1..f14e80194 100644 --- a/libmu_sieve/sieve-lex.l +++ b/libmu_sieve/sieve-lex.l @@ -190,6 +190,7 @@ push_source (const char *name) { ctx = mu_sieve_malloc (mu_sieve_machine, sizeof (*ctx)); ctx->trk = trk; + mu_locus_range_init (&ctx->incl_range); mu_locus_range_copy (&ctx->incl_range, &yylloc); ctx->i_node = sieve_source_inode; ctx->input = input_stream; diff --git a/libmu_sieve/util.c b/libmu_sieve/util.c index 8d62a60c2..7d71b5509 100644 --- a/libmu_sieve/util.c +++ b/libmu_sieve/util.c @@ -55,6 +55,7 @@ mu_sieve_value_create (mu_sieve_machine_t mach, mu_sieve_data_type type, val->locus.end.mu_line = locus->end.mu_line; val->locus.end.mu_col = locus->end.mu_col; + mu_locus_range_init (&val->locus); mu_locus_range_copy (&val->locus, locus); switch (type) { diff --git a/mh/mh_alias_lex.l b/mh/mh_alias_lex.l index 371353ed3..b97264b38 100644 --- a/mh/mh_alias_lex.l +++ b/mh/mh_alias_lex.l @@ -167,6 +167,7 @@ push_source (const char *name, int fail) { ctx = mu_alloc (sizeof (*ctx)); ctx->trk = trk; + mu_locus_range_init (&ctx->incl_range); mu_locus_range_copy (&ctx->incl_range, &yylloc); ctx->exec_p = exec_p; ctx->i_node = ali_source_inode;