MemorySanitizer fails to report Use-Of-Uninitialized value in Pointer arithmetic with boolean operation.

[lowroller26]

Clang19_use_of_uninint.zip

[hstk30-hw]

Can you try clang 20?

[firewave]

Please do not simply drop an archive without context into a bug report. That is bad for various reasons and on the surface looks like somebody is trying to push potentially malicious content.

#include<stdio.h>
#include<stdlib.h>

int main() {
  int *b = malloc(4);
  int c;
  if ((c) + b) {
    *b = 1;
  }
  printf("*b = %d\n", *b);
  free(b);
  return 0;
}

The uninitialized c is detected by Clang and GCC via compiler warnings: https://godbolt.org/z/j9W4T4qfb

<source>:8:8: warning: variable 'c' is uninitialized when used here [-Wuninitialized]
    8 |   if ((c) + b) {
      |        ^
<source>:7:8: note: initialize the variable 'c' to silence this warning
    7 |   int c;
      |        ^
      |         = 0

<source>: In function 'main':
<source>:8:11: warning: 'c' is used uninitialized [-Wuninitialized]
    8 |   if ((c) + b) {
      |           ^
<source>:7:7: note: 'c' was declared here
    7 |   int c;
      |       ^

This has nothing to do with allocations at all. Or am I missing something here?

[firewave]

Please do not simply drop an archive without context into a bug report.

I am terribly sorry but I overlooked the README.md.

So it is about b potentially being used uninitialized when the if condition doesn't hit. Still the code is flawed since c is uninitialized in all cases. So unless c is also 0 or malloc() fails the condition will always be true - and if the latter isn't true you would deference a NULL pointer.

[lowroller26]

Sorry, for the lack of transparency. The issue I was raising was that c is uninitialized and in the test file bug.c, when it is ran using -fsanitize=memory there is no compiler warning or error raised. The other test files hinted that it has something to do with both the boolean operation (c != 0) and the addition of strictly a pointer.

[lowroller26]

Can you try clang 20?

Yes and the bug persists.

Also to clarify "Use of uninitialised variable (b) that is not reported:" is a typo in README.md it should say "Use of uninitialised variable (c) that is not reported:"