[devel] [PATCH 2/5] mbc: fix access uninitialised value [#3326]

[thien.m.huynh]

---
 src/mbc/mbcsv_act.c  | 2 ++
 src/mbc/mbcsv_api.c  | 4 ++++
 src/mbc/mbcsv_tmr.c  | 1 +
 src/mbc/mbcsv_util.c | 6 ++++++
 4 files changed, 13 insertions(+)

diff --git a/src/mbc/mbcsv_act.c b/src/mbc/mbcsv_act.c
index ae0e8e539..690b7ea35 100644
--- a/src/mbc/mbcsv_act.c
+++ b/src/mbc/mbcsv_act.c
@@ -382,6 +382,8 @@ uint32_t ncs_mbscv_rcv_decode(PEER_INST *peer, MBCSV_EVT 
*evt)
        MBCSV_REG *mbc_inst = peer->my_ckpt_inst->my_mbcsv_inst;
        TRACE_ENTER();
 
+       memset(&parg, '\0', sizeof(NCS_MBCSV_CB_ARG));
+
        parg.i_client_hdl = peer->my_ckpt_inst->client_hdl;
        parg.i_ckpt_hdl = peer->my_ckpt_inst->ckpt_hdl;
 
diff --git a/src/mbc/mbcsv_api.c b/src/mbc/mbcsv_api.c
index 3a84fdfda..411c8944c 100644
--- a/src/mbc/mbcsv_api.c
+++ b/src/mbc/mbcsv_api.c
@@ -742,6 +742,8 @@ uint32_t mbcsv_process_chg_role_request(NCS_MBCSV_ARG *arg)
                rc = SA_AIS_ERR_NO_MEMORY;
                goto err2;
        }
+       memset(evt, '\0', sizeof(MBCSV_EVT));
+
        evt->msg_type = MBCSV_EVT_INTERNAL;
        evt->info.peer_msg.type = MBCSV_EVT_CHG_ROLE;
        evt->info.peer_msg.info.chg_role.ckpt_hdl =
@@ -859,6 +861,8 @@ uint32_t mbcsv_process_snd_ckpt_request(NCS_MBCSV_ARG *arg)
                        goto err2;
                }
 
+               memset(evt, '\0', sizeof(MBCSV_EVT));
+
                evt->msg_type = MBCSV_EVT_INTERNAL;
                evt->info.peer_msg.type = MBCSV_EVT_MBC_ASYNC_SEND;
                memcpy(&evt->info.peer_msg.info.usr_msg_info,
diff --git a/src/mbc/mbcsv_tmr.c b/src/mbc/mbcsv_tmr.c
index b3d9b3e81..641adf5f2 100644
--- a/src/mbc/mbcsv_tmr.c
+++ b/src/mbc/mbcsv_tmr.c
@@ -247,6 +247,7 @@ void ncs_mbcsv_tmr_expiry(void *uarg)
                TRACE_LEAVE2("malloc failed");
                return;
        }
+       memset(mbc_evt, '\0', sizeof(MBCSV_EVT));
 
        /* Extract timer expiration info from uarg. */
        tmr = (NCS_MBCSV_TMR *)uarg;
diff --git a/src/mbc/mbcsv_util.c b/src/mbc/mbcsv_util.c
index 8758bf3ea..38a17cf17 100644
--- a/src/mbc/mbcsv_util.c
+++ b/src/mbc/mbcsv_util.c
@@ -424,6 +424,8 @@ uint32_t 
mbcsv_send_ckpt_data_to_all_peers(NCS_MBCSV_SEND_CKPT *msg_to_send,
                TRACE("calling encode callback");
                uba = &parg.info.encode.io_uba;
                memset(uba, '\0', sizeof(NCS_UBAID));
+               memset(&parg, '\0', sizeof(NCS_MBCSV_CB_ARG));
+               memset(&evt_msg, '\0', sizeof(MBCSV_EVT));
 
                if (NCSCC_RC_SUCCESS != ncs_enc_init_space(uba)) {
                        TRACE_LEAVE2("encode init failed");
@@ -792,6 +794,8 @@ uint32_t mbcsv_send_data_req(NCS_UBAID *uba, CKPT_INST 
*ckpt_inst,
        MBCSV_EVT evt_msg;
        TRACE_ENTER();
 
+       memset(&evt_msg, '\0', sizeof(MBCSV_EVT));
+
        /*
         * Generate the message to be sent.
         */
@@ -838,6 +842,7 @@ uint32_t mbcsv_send_client_msg(PEER_INST *peer, uint8_t 
evt, uint32_t action)
                TRACE_LEAVE2("malloc failed");
                return NCSCC_RC_FAILURE;
        }
+       memset(evt_msg, '\0', sizeof(MBCSV_EVT));
 
        /*
         * Generate the message to be sent.
@@ -889,6 +894,7 @@ uint32_t ncs_mbcsv_encode_message(PEER_INST *peer, 
MBCSV_EVT *evt_msg,
         * Call encode callback to encode message to be sent.
         */
        memset(uba, '\0', sizeof(NCS_UBAID));
+       memset(&parg, '\0', sizeof(NCS_MBCSV_CB_ARG));
 
        if (NCSCC_RC_SUCCESS != ncs_enc_init_space(uba)) {
                TRACE_LEAVE2("leap enc init failed");
-- 
2.38.1



_______________________________________________
Opensaf-devel mailing list
Opensaf-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/opensaf-devel