Re: Question about flock - potential memory corruption?

[Qian Hong <fracting at gmail dot com>]

Hi,

I was still not able to make valgrind display Cygwin symbols, so I
manually translate the address to line this time.

Tested with
$ uname -a
CYGWIN_NT-5.1  2.2.1(0.289/5/3) 2015-08-20 11:40 i686 Cygwin

==29863== Conditional jump or move depends on uninitialised value(s)
==29863==    at 0x7BC82768: RtlGetOwnerSecurityDescriptor (sec.c:740)
==29863==    by 0x7BC92356: NTDLL_create_struct_sd (sync.c:96)
==29863==    by 0x7BC92E10: NtCreateEvent (sync.c:294)
==29863==    by 0x6107B937: ???
==29863==    by 0x61304697: ???

Here 0x6107b937 is the call to NtCreateEvent() inside
lockf_t::create_lock_obj() at:
https://cygwin.com/git/gitweb.cgi?p=newlib-cygwin.git;a=blob;f=winsup/cygwin/flock.cc;h=2332f5467e37d124acfd12c0f85a30281f10a952;hb=HEAD#l772

(I can't explain what the address 0x61304697 means, it seems a bit
weird to me, not sure if it is valgrind related)

Related Wine source code:
https://github.com/wine-compholio/wine-patched/blob/8b3a785e97a7e28ff58731b58d19237a59239acc/dlls/ntdll/sync.c#L294
https://github.com/wine-compholio/wine-patched/blob/8b3a785e97a7e28ff58731b58d19237a59239acc/dlls/ntdll/sync.c#L96
https://github.com/wine-compholio/wine-patched/blob/8b3a785e97a7e28ff58731b58d19237a59239acc/dlls/ntdll/sec.c#L740

According to valgrind, lpsd->Control in
RtlGetOwnerSecurityDescriptor() is uninitialized, which means
((SECURITY_DESCRIPTOR*)attr->SecurityDescriptor)->Control in
NtCreateEvent(,attr,) is not initialized, that's why I'm looking at
create_lock_obj_attr() and everyone_sd(). It seems after
create_lock_obj_attr returned the memory allocated by alloca() is
gone, which cause the valgrind warnings, also cause the random
failures.

If there is any further information required I'm glad to test and provide.

Any comments are great appreciated!

Thanks again!

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple