[PATCH 1/2] unit: memset band to zero after alloc

[PATCH 1/2] unit: memset band to zero after alloc

[James Prestwood]

In test-band the band object was allocated using l_malloc, but not
memset to zero. This will cause problems if allocated pointers are
included in struct band once band is freed.
---
 unit/test-band.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/unit/test-band.c b/unit/test-band.c
index 757db377..0dd9b67b 100644
--- a/unit/test-band.c
+++ b/unit/test-band.c
@@ -52,6 +52,8 @@ static struct band *new_band()
 	/* band + 8 basic rates */
 	struct band *band = l_malloc(sizeof(struct band) + 8);
 
+	memset(band, 0, sizeof(struct band) + 8);
+
 	band->supported_rates_len = 8;
 	band->supported_rates[0] = 12;
 	band->supported_rates[1] = 18;
-- 
2.34.1

[PATCH 2/2] wiphy: fix strange compiler bug with gcc 11.2

[James Prestwood]

There appears to be a compiler bug with gcc 11.2 which thinks the vht_mcs_set
is a zero length array, and the memset of size 8 is out of bounds. This is only
seen once an element is added to 'struct band'.

In file included from /usr/include/string.h:519,
                 from src/wiphy.c:34:
In function ‘memset’,
    inlined from ‘band_new_from_message’ at src/wiphy.c:1300:2,
    inlined from ‘parse_supported_bands’ at src/wiphy.c:1423:11,
    inlined from ‘wiphy_parse_attributes’ at src/wiphy.c:1596:5,
    inlined from ‘wiphy_update_from_genl’ at src/wiphy.c:1773:2:
/usr/include/bits/string_fortified.h:59:10: error: ‘__builtin_memset’ offset [0, 7] is out of the bounds [0, 0] [-Werror=array-bounds]
   59 |   return __builtin___memset_chk (__dest, __ch, __len,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   60 |                                  __glibc_objsize0 (__dest));
      |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~
---
 src/wiphy.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/wiphy.c b/src/wiphy.c
index a52d0941..4dcfb8b3 100644
--- a/src/wiphy.c
+++ b/src/wiphy.c
@@ -1187,7 +1187,15 @@ static struct band *band_new_from_message(struct l_genl_attr *band)
 	toalloc = sizeof(struct band) + count * sizeof(uint8_t);
 	ret = l_malloc(toalloc);
 	memset(ret, 0, toalloc);
+
+#if __GNUC__ == 11 && __GNUC_MINOR__ == 2
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Warray-bounds\"")
+#endif
 	memset(ret->vht_mcs_set, 0xff, sizeof(ret->vht_mcs_set));
+#if __GNUC__ == 11 && __GNUC_MINOR__ == 2
+_Pragma("GCC diagnostic pop")
+#endif
 
 	return ret;
 }
-- 
2.34.1

Re: [PATCH 1/2] unit: memset band to zero after alloc

[Denis Kenzior]

Hi James,

On 7/19/22 17:29, James Prestwood wrote:
> In test-band the band object was allocated using l_malloc, but not
> memset to zero. This will cause problems if allocated pointers are
> included in struct band once band is freed.
> ---
>   unit/test-band.c | 2 ++
>   1 file changed, 2 insertions(+)
> 

Both applied, thanks.

Regards,
-Denis