News:

The Forum Rules and Guidelines
Our forum has Rules and Guidelines. Please, be kind and read them ;).

network: stop rdwr_bool reading uninitialised destination

Started by janry, Yesterday at 03:26:14 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

janry

 
    memory_rw_t::rdwr_bool unconditionally does `uint8 b = i` before
    calling rdwr_byte.  On the load path `i` is the output reference and
    its value at that moment is whatever the caller left there —
    typically uninitialised, since the caller created the command via
    the default ctor and is about to overwrite the field from the wire.
    Reading an uninitialised bool is UB UBSAN reports
   
      load of value 190, which is not a valid value for type 'bool'
   
    at memory_rw.cc:56, with the call chain network_command_t::receive
    → rdwr() cascade → rdwr_bool(scripted_call), where scripted_call is
    the uninitialised bool field of nwc_chg_player_t (its default ctor,
    the one read_from_packet uses, omits it from the initialiser list).
   
    Source `b` from `i` only on save on load `b` is just a wire scratch
    byte that rdwr_byte fills before we write back to `i`.  Fixes the
    class of bug at the read site rather than chasing every
    uninitialised bool field across all rdwr-able commands.