<html aria-label="message body"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Thanks, I initialized to 0 always now.<div><br></div><div>Best,</div><div><br></div><div>christos<br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Feb 23, 2026, at 9:31 PM, Steve Grubb <sgrubb@redhat.com> wrote:</div><br class="Apple-interchange-newline"><div>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em><defanged_span style="font-family:Lato Light;">Hello Christos, </defanged_span></em></defanged_span></defanged_span></p>
<br><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>In src/softmagic.c, we have the msetoffset function. bb can be uninitialized </em></defanged_span></defanged_span></p><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>under the right conditions. At the test, if (b->fd == -1), if that is true it </em></defanged_span></defanged_span></p><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>updates some offsets and does not call buffer_init. It skips both else </em></defanged_span></defanged_span></p><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>statements. It continue execution at "if ((ms->flags & MAGIC_DEBUG) != 0)" </em></defanged_span></defanged_span></p><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>where it might use them uninitialized if MAGIC_DEBUG was passed. But later </em></defanged_span></defanged_span></p><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>after the function returns, it will call mget passing bb.fbuf and bb.flen </em></defanged_span></defanged_span></p><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>which are uninitialized. They will be whatever the stack contents are. </em></defanged_span></defanged_span></p>
<br><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>The minimal fix is to unconditionally initialize bb at the beginning of the </em></defanged_span></defanged_span></p><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>function. I'm setting it to the value initialized in the normal branch. I </em></defanged_span></defanged_span></p><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>think those are what gets passed to mget(). Because it was already set at the beginning of the function, down below I deleted that one. </em></defanged_span></defanged_span></p>
<br><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>You know the code better than I do. You may choose a different solution. </em></defanged_span></defanged_span></p><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>Anyways, just wanted to pass this along. I found this with scan-build, which </em></defanged_span></defanged_span></p><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>is part of clang-analyzer. </em></defanged_span></defanged_span></p>
<br><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>Best Regards,</em></defanged_span></defanged_span></p><p defanged_style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><defanged_span style="background-color:#ffffff;"><defanged_span style="color:#232629;"><em>-Steve</em></defanged_span></defanged_span></p>
</div>
<span id="cid:4783806F-494F-4659-9388-A4EEAFAFF659"><uninit.patch></span>-- <br>File mailing list<br>File@astron.com<br>https://mailman.astron.com/mailman/listinfo/file<br><span id="cid:F91CA314-CA37-4434-A507-BEB2466A4C09"><sanitizer.log></span></div></blockquote></div><br></div></body></html>