From: Mark Adler <madler@alumni.caltech.edu>
Date: Wed, 28 Jan 2009 23:06:44 GMT
Subject: Re: Valgrind updates
Message-ID: <69A01114-27BB-4239-8FD8-C35D1306CE25@alumni.caltech.edu>
In-Reply-To: <alpine.LFD.2.00.0901271006060.3123@localhost.localdomain>

On Jan 27, 2009, at 10:55 AM, Linus Torvalds wrote:
> and valgrind complains that the "write_buffer()" call will touch an
> uninitialized byte (just one byte, and in the _middle_ of the  
> buffer, no
> less):

Linus,

That is definitely not deflate's intentional use of uninitialized  
bytes that is noted in the zlib FAQ.  This is something else.

> Maybe the zlib people can tell us that we're idiots and the above is
> buggy, but maybe there is a real bug in zlib.

I can't speak to the idiot part, but your usage of deflate is not  
buggy.  (At least assuming that NULL is all zeros for the compiler in  
use.)

If this is all correct, it sounds like a serious bug in deflate.  If  
so, it would have to be a very sneaky bug to not have been discovered  
over the last decade or so of deflate usage on who knows how many  
zettabytes of data.  The deflate code has remained largely unchanged  
in that time, and there really isn't anything unusual about your usage.

I have some questions:

1.  Is this problem reproducible on more than one machine?

2.  Can someone send me the input and the 58 bytes of output from this  
case?

3.  Did you try decompressing the 58 bytes?

4.  For the detection of an "uninitialized byte", if for example an  
uninitialized byte is copied to another location, is that location  
then also considered uninitialized?  Or does uninitialized mean that  
that location has really never been written to?

5.  Would the access of uninitialized bytes by deflate have been  
detected?  Since I don't see a mention of uninitialized access before  
the write_buffer(), does that mean that deflate never did such a thing  
itself?

Mark