Skip to content

Valgrind: Conditional jump or move depends on uninitialised value in ob_digit[0] of PyLongObject #119022

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
OveSo opened this issue May 14, 2024 · 2 comments
Labels
type-bug An unexpected behavior, bug, or error

Comments

@OveSo
Copy link

OveSo commented May 14, 2024

Bug report

Bug description:

There are several cases, where ob_digit[0] of PyLongObject will not be initialized before evaluation.
I fixed that issue in Python 3.11.8 with this patch - it also concerns Python 3.11.9:

--- longobject.c_orig	2024-02-06 22:21:21.000000000 +0100
+++ longobject.c	2024-05-13 17:47:25.846011498 +0200
@@ -165,6 +165,7 @@
         return NULL;
     }
     _PyObject_InitVar((PyVarObject*)result, &PyLong_Type, size);
+    result->ob_digit[0] = 0;
     return result;
 }

For example, one case is in longobject.c:922 in _PyLong_FromByteArray() if numsignificantbytes==0.
First, I fixed it locally in _PyLong_FromByteArray() but than I found similar cases in other functions.
Therefore, I decided to initialize ob_digit[0] right in _PyLong_New() in order to catch all situations.
Kind regards,
Ove

CPython versions tested on:

3.11

Operating systems tested on:

Linux

@OveSo OveSo added the type-bug An unexpected behavior, bug, or error label May 14, 2024
@sweeneyde
Copy link
Member

Just an initial comment: I'm assuming this was fixed in 3.12+ by #102509.

3.11 looks like it's only accepting security fixes now, but I'm not sure whether this qualifies or not.

@sobolevn
Copy link
Member

Yes, this was fixed in #102510

3.11 is security only, so it was not backported.
3.12+ are fixed.

@sobolevn sobolevn closed this as not planned Won't fix, can't repro, duplicate, stale May 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type-bug An unexpected behavior, bug, or error
Projects
None yet
Development

No branches or pull requests

3 participants