<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em><span style="font-family:Lato Light;">Hello Christos, </span></em></span></span></p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>In src/softmagic.c, we have the msetoffset function. bb can be uninitialized </em></span></span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>under the right conditions. At the test, if (b->fd == -1), if that is true it </em></span></span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>updates some offsets and does not call buffer_init. It skips both else </em></span></span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>statements. It continue execution at "if ((ms->flags & MAGIC_DEBUG) != 0)" </em></span></span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>where it might use them uninitialized if MAGIC_DEBUG was passed. But later </em></span></span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>after the function returns, it will call mget passing bb.fbuf and bb.flen </em></span></span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>which are uninitialized. They will be whatever the stack contents are. </em></span></span></p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>The minimal fix is to unconditionally initialize bb at the beginning of the </em></span></span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>function. I'm setting it to the value initialized in the normal branch. I </em></span></span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>think those are what gets passed to mget(). Because it was already set at the beginning of the function, down below I deleted that one. </em></span></span></p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>You know the code better than I do. You may choose a different solution. </em></span></span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>Anyways, just wanted to pass this along. I found this with scan-build, which </em></span></span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>is part of clang-analyzer. </em></span></span></p>
<br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>Best Regards,</em></span></span></p>
<p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span style="background-color:#ffffff;"><span style="color:#232629;"><em>-Steve</em></span></span></p>
</body>
</html>