<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Two subsequent display roundtrips results sendmsg syscall with uninitialized bytes"
href="https://bugs.freedesktop.org/show_bug.cgi?id=94071#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Two subsequent display roundtrips results sendmsg syscall with uninitialized bytes"
href="https://bugs.freedesktop.org/show_bug.cgi?id=94071">bug 94071</a>
from <span class="vcard"><a class="email" href="mailto:jadahl@gmail.com" title="Jonas Ådahl <jadahl@gmail.com>"> <span class="fn">Jonas Ådahl</span></a>
</span></b>
<pre>(In reply to Jon from <a href="show_bug.cgi?id=94071#c3">comment #3</a>)
<span class="quote">> (In reply to Jonas Ådahl from <a href="show_bug.cgi?id=94071#c2">comment #2</a>)
> > (In reply to Jon from <a href="show_bug.cgi?id=94071#c1">comment #1</a>)
> > > Note, a normal execution (not with valgrind) results in SIGSEGV (Address
> > > boundary error).
> >
> > Are you sure there is a compositor running when you run your test case? I
> > can only reproduce a SIGSEGV if there is no Wayland compositor to connect
> > to. If it succeeds connecting, I only get the valgrind warning, no SIGSEGV.
>
> Oops, sorry. Yeah the SIGSEGV only occurs if there's no compositor. The
> sendmsg valgrind error still occurs in either case though.</span >
The reason is that we align the buffers by 4 bytes. So that when we put a
string "ab" which is 3 bytes including '\0', we write:
0-3: [sender id]
4-5: [3 bytes long message]
6-7: [op code]
8-10: "ab\0"
11: [uninitialized]
The reader will read bytes 4-5 and then not read the uninitialized data.
This, is, more or less harmless, accept for the fact that we are sending
uninitialized bytes from the one process's memory to another, which I would say
is a security issue at least when the closure is sent from the server to the
client. I'm sending a patch making the memory initialized to 0, so we avoid
padding with uninitialized bytes.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>