use of uninitialised values in _mzd_copy_transpose_lt64x64

[Martin Albrecht]

The following code in mzd.c only initialises t up to index n:

static inline void _mzd_copy_transpose_lt64x64(word* RESTRICT dst, word const* RESTRICT src, wi_t rowstride_dst, wi_t rowstride_src, int n)
{
  word t[64];
  word const* RESTRICT wks = src;
  int k;
  for (k = 0; k < n; ++k) {
    t[k] = *wks;
    wks += rowstride_src;
  }
  if (n > 32) {
    while (k < 64)
      t[k++] = 0;
    _mzd_copy_transpose_64x64(dst, t, rowstride_dst, 1);
    return;
  }
  int log2j = _mzd_transpose_Nxjx64(t, n);

However, running valgrind on

#include <stdio.h>
#include <stdlib.h>
#include "m4ri.h"

int main()
{
        int r = 144;
        int l = 10;
        int i, j;
        mzd_t* A = mzd_init(r, r-l);
        mzd_t* AT = mzd_init(r-l, r);
        mzd_randomize(AT);

        mzd_transpose(A, AT);

        BIT a;
        for (i = 0; i < AT->nrows; ++i) {
                for (j = 0; j < AT->ncols; ++j) {
                        a = mzd_read_bit(AT, i, j);
                        printf("%d", a);
                }
        }
        for (i = 0; i < A->nrows; ++i) {
                for (j = 0; j < A->ncols; ++j) {
                        a = mzd_read_bit(A, i, j);
                        printf("%d", a);
                }
        }

        mzd_free(A);
        mzd_free(AT);
        return 0;
}

indicates t[k] for k>=n is accessed.

Reported by Grégory Landais.

[Charles Bouillaguet]

Hi Martin and friends,

I'm bit by the very same problem. It's mildly annoying because my programs (using M4RI) report lots of such errors. Just doing:

#include <stdlib.h>
#include <m4ri/m4ri.h>

int main()
{
    mzd_t *A = mzd_init(13, 64);
    mzd_randomize(A);
    mzd_t *E = mzd_transpose(NULL, A);
    mzd_print(E);
}

triggers it. Computing the PLUQ of the transpose triggers it more.

EDIT : this only happens when the input matrix has less than 32 rows. Indeed, when n >= 32, the

while (k < 64)
      t[k++] = 0;

chunk completely initializes t.

[Martin Albrecht]

force initialisation of t in _mzd_copy_transpose_lt64x64

fixes #53

→ <<cset b9897d5bcc0f>>