Bug#1017426: libnss3: Uninitialised value was created by a stack allocation

[ax...@me.com]

Package: libnss3
Version: 2:3.79-1
Severity: normal

Dear Maintainer,

debuging valgrind pidgin with result:

==804198== Uninitialised value was created by a stack allocation
==804198== at 0xB089DC0: ssl3_MACEncryptRecord (ssl3con.c:2104)

line correspopnds to the ssl3_MACEncryptRecord

-- System Information:
Debian Release: bookworm/sid
APT prefers testing-debug
APT policy: (500, 'testing-debug'), (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.18.0-3-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libnss3 depends on:
ii libc6 2.33-8
ii libnspr4 2:4.34-1
ii libsqlite3-0 3.39.2-1

libnss3 recommends no packages.

libnss3 suggests no packages.

-- no debconf information

[Alexey Kuznetsov]

On Tue, Aug 16, 2022 at 9:00 AM Mike Hommey <m...@glandium.org> wrote:

On Tue, Aug 16, 2022 at 08:30:07AM +0300, ax...@me.com wrote:
> Package: libnss3
> Version: 2:3.79-1
> Severity: normal
>
> Dear Maintainer,
>
> debuging valgrind pidgin with result:
>
> ==804198==  Uninitialised value was created by a stack allocation
> ==804198==    at 0xB089DC0: ssl3_MACEncryptRecord (ssl3con.c:2104)
>
> line correspopnds to the ssl3_MACEncryptRecord

Looking at the code, it would seem to be a false positive, but I might
have overlooked something, but you haven't pasted the most interesting
parts of the valgrind output...

Mike

This output comes exactly from valgrind. No usual stack trace. Before and below are different issues.

BTW pidgin crashing sometimes, and only issues I can record points to the nss library.

 

[Mike Hommey]

On Tue, Aug 16, 2022 at 08:30:07AM +0300, ax...@me.com wrote:

> Package: libnss3
> Version: 2:3.79-1
> Severity: normal
>
> Dear Maintainer,
>
> debuging valgrind pidgin with result:
>
> ==804198== Uninitialised value was created by a stack allocation
> ==804198== at 0xB089DC0: ssl3_MACEncryptRecord (ssl3con.c:2104)
>
> line correspopnds to the ssl3_MACEncryptRecord

[Mike Hommey]

Usually, "Uninitialised value was created by a stack allocation" is the
reason for the error, with a stack trace, that comes above it. That's
the most crucial information. Without that, we don't know what is trying
to use that unitialized value.

[Alexey Kuznetsov]

 Ok .Let me restart pidgin. It 100% reproducible. Only thing you need is to install dbgsym for glibc, nss3, pidgin and add frew irc and jabber accounts (I also using matrix plugin). Command would be:

G_SLICE=always-malloc valgrind --num-callers=30 --track-origins=yes pidgin 2>&1 | tee 123.log

https://paste.debian.net/1250580/

[Mike Hommey]

Can you reproduce with 3.81-1 in unstable?

For posterity, the useful information:

==837133== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==837133== at 0x5A153D6: __libc_send (send.c:28)
==837133== by 0x5A153D6: send (send.c:23)
==837133== by 0xB083527: pt_Send (ptio.c:2002)
==837133== by 0xB01DFF7: ssl_DefSend (ssldef.c:105)
==837133== by 0xB0229C0: ssl_SendSavedWriteData (sslsecur.c:452)
==837133== by 0xB006839: ssl3_SendRecord (ssl3con.c:2568)
==837133== by 0xB006C2C: ssl3_FlushHandshakeMessages (ssl3con.c:2774)
==837133== by 0xB006C2C: ssl3_FlushHandshake (ssl3con.c:2747)
==837133== by 0xB00F5E4: ssl3_SendFinished (ssl3con.c:11944)
==837133== by 0xB00FB79: ssl3_SendClientSecondRound (ssl3con.c:8191)
==837133== by 0xB011A7A: ssl3_HandleServerHelloDone (ssl3con.c:8061)
==837133== by 0xB011A7A: ssl3_HandlePostHelloHandshakeMessage (ssl3con.c:12568)
==837133== by 0xB011A7A: ssl3_HandleHandshakeMessage (ssl3con.c:12479)
==837133== by 0xB014A74: ssl3_HandleHandshake (ssl3con.c:12653)
==837133== by 0xB014A74: ssl3_HandleNonApplicationData (ssl3con.c:13188)
==837133== by 0xB0153C0: ssl3_HandleRecord (ssl3con.c:13529)
==837133== by 0xB01B500: ssl3_GatherCompleteHandshake (ssl3gthr.c:561)
==837133== by 0xB01B500: ssl3_GatherCompleteHandshake (ssl3gthr.c:449)
==837133== by 0xB022A80: SSL_ForceHandshake (sslsecur.c:382)
==837133== by 0xADCC8D6: ssl_nss_handshake_cb (ssl-nss.c:371)
==837133== by 0x1824B1: pidgin_io_invoke (gtkeventloop.c:73)
==837133== by 0x54BBA9E: g_main_dispatch (gmain.c:3417)
==837133== by 0x54BBA9E: g_main_context_dispatch (gmain.c:4135)
==837133== by 0x54BBE57: g_main_context_iterate.constprop.0 (gmain.c:4211)
==837133== by 0x54BC10E: g_main_loop_run (gmain.c:4411)
==837133== by 0x4C57B29: gtk_main (in /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0.2400.33)
==837133== by 0x145D7B: main (gtkmain.c:948)
==837133== Address 0x1b82e246 is 534 bytes inside a block of size 1,553 alloc'd
==837133== at 0x484582F: realloc (vg_replace_malloc.c:1437)
==837133== by 0xB2114A1: PORT_Realloc_Util (secport.c:101)
==837133== by 0xB01E1E4: sslBuffer_Grow (sslencode.c:50)
==837133== by 0xB01E1E4: sslBuffer_Grow (sslencode.c:31)
==837133== by 0xB01E42B: sslBuffer_Append (sslencode.c:82)
==837133== by 0xB006817: ssl3_SendRecord (ssl3con.c:2559)
==837133== by 0xB006C2C: ssl3_FlushHandshakeMessages (ssl3con.c:2774)
==837133== by 0xB006C2C: ssl3_FlushHandshake (ssl3con.c:2747)
==837133== by 0xB00F5E4: ssl3_SendFinished (ssl3con.c:11944)
==837133== by 0xB00FB79: ssl3_SendClientSecondRound (ssl3con.c:8191)
==837133== by 0xB011A7A: ssl3_HandleServerHelloDone (ssl3con.c:8061)
==837133== by 0xB011A7A: ssl3_HandlePostHelloHandshakeMessage (ssl3con.c:12568)
==837133== by 0xB011A7A: ssl3_HandleHandshakeMessage (ssl3con.c:12479)
==837133== by 0xB014A74: ssl3_HandleHandshake (ssl3con.c:12653)
==837133== by 0xB014A74: ssl3_HandleNonApplicationData (ssl3con.c:13188)
==837133== by 0xB0153C0: ssl3_HandleRecord (ssl3con.c:13529)
==837133== by 0xB01B500: ssl3_GatherCompleteHandshake (ssl3gthr.c:561)
==837133== by 0xB01B500: ssl3_GatherCompleteHandshake (ssl3gthr.c:449)
==837133== by 0xB022A80: SSL_ForceHandshake (sslsecur.c:382)
==837133== by 0xADCC8D6: ssl_nss_handshake_cb (ssl-nss.c:371)
==837133== by 0x1824B1: pidgin_io_invoke (gtkeventloop.c:73)
==837133== by 0x54BBA9E: g_main_dispatch (gmain.c:3417)
==837133== by 0x54BBA9E: g_main_context_dispatch (gmain.c:4135)
==837133== by 0x54BBE57: g_main_context_iterate.constprop.0 (gmain.c:4211)
==837133== by 0x54BC10E: g_main_loop_run (gmain.c:4411)
==837133== by 0x4C57B29: gtk_main (in /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0.2400.33)
==837133== by 0x145D7B: main (gtkmain.c:948)
==837133== Uninitialised value was created by a stack allocation
==837133== at 0xB005DC0: ssl3_MACEncryptRecord (ssl3con.c:2104)

[Alexey Kuznetsov]

Oh, I didn't know this is related. So, nice to know. I am able to reproduce the same error log for 3.81-1, unfortunately I do not know how to install debsym for unstable.

Full log with gtk issues:

https://paste.debian.net/1250584/