1. Martin Albrecht
  2. m4ri
  3. Issues
Issue #53 new

use of uninitialised values in _mzd_copy_transpose_lt64x64

Martin Albrecht
repo owner created an issue

The following code in mzd.c only initialises t up to index n:

static inline void _mzd_copy_transpose_lt64x64(word* RESTRICT dst, word const* RESTRICT src, wi_t rowstride_dst, wi_t rowstride_src, int n)
{
  word t[64];
  word const* RESTRICT wks = src;
  int k;
  for (k = 0; k < n; ++k) {
    t[k] = *wks;
    wks += rowstride_src;
  }
  if (n > 32) {
    while (k < 64)
      t[k++] = 0;
    _mzd_copy_transpose_64x64(dst, t, rowstride_dst, 1);
    return;
  }
  int log2j = _mzd_transpose_Nxjx64(t, n);

However, running valgrind on

#include <stdio.h>
#include <stdlib.h>
#include "m4ri.h"

int main()
{
        int r = 144;
        int l = 10;
        int i, j;
        mzd_t* A = mzd_init(r, r-l);
        mzd_t* AT = mzd_init(r-l, r);
        mzd_randomize(AT);

        mzd_transpose(A, AT);

        BIT a;
        for (i = 0; i < AT->nrows; ++i) {
                for (j = 0; j < AT->ncols; ++j) {
                        a = mzd_read_bit(AT, i, j);
                        printf("%d", a);
                }
        }
        for (i = 0; i < A->nrows; ++i) {
                for (j = 0; j < A->ncols; ++j) {
                        a = mzd_read_bit(A, i, j);
                        printf("%d", a);
                }
        }

        mzd_free(A);
        mzd_free(AT);
        return 0;
}

indicates t[k] for k>=n is accessed.

Reported by Grégory Landais.

Comments (0)

  1. Log in to comment