On 8/4/07, Bram Moolenaar <[EMAIL PROTECTED]> wrote:
>
> Dominique Pelle wrote:
>
> > Hi,
> >
> > Valgrind memory checker finds several errors in vim-7.1 (patches 1-50)
> > when built with --enable-multibyte:
> >
> > $ ./configure --enable-multibyte
> > $ make CFLAGS="-O0 -g"
> > $ cd src/testdir
> > $ valgrind ../vim -u unix.vim -U NONE --noplugin -s dotest.in
> > test45.in 2> valgrind-test45.txt

...

> It's a lot of work to check out the warnings, so please make sure there
> are no false warnings.

Hi

I sent this patch yesterday but I believe I need to sent it to
vim_dev at googlegroups.com instead of vim-dev at vim.org
(since I don't see my message at all in the archive archive).
Hopefully it does not arrive twice.

I have a patch to fix errors reported by valgrind in test case 45
but please review it.

Error was:

==14428== Conditional jump or move depends on uninitialised value(s)
==14428==    at 0x80FDD10: utfc_ptr2len (mbyte.c:1676)
==14428==    by 0x813EB6B: win_line (screen.c:3586)
==14428==    by 0x813BBF0: win_update (screen.c:1760)
==14428==    by 0x8139FFE: update_screen (screen.c:522)
==14428==    by 0x80CD1CF: main_loop (main.c:1088)
==14428==    by 0x80CCF72: main (main.c:939)
etc.

Variable p_extra at screen.c:3586 was initialized by fill_foldcolumn()
with 'foldcolumn' spaces (3 spaces in test case 45). 'p_extra' pointer
is actually in this case the local 'extra' array. The rest of 'p_extra'
buffer is uninitialized. vim_line() then loops on those 3 spaces but
accesses the next characters inside utfc_ptr2len() when multi_byte
is enabled, hence causing valgrind to complain when displaying
the last space.

Bug can be simply triggered when doing ":set foldcolumn" and when
vim was built 'multi_byte'.  The following command is enough to trigger
an error with valgrind:

 $ vim -u NONE -c 'set foldcolumn=4'  2> valgrind.log

I attach the patch to fix the problem.  It basically adds NUL character
at the end of 'foldcolumn' spaces when. This patch actually fixes all errors
reported by valgrind in test case 45.

Without patch, bahavior of calling utfc_ptr2len() at line screen.c:3586
may be undetermined.  It's also slower since it may need to call
utf_ptr2len() whereas with patch, function utfc_ptr2len() returns
immediately at mbyte.c:1676.

Cheers
-- Dominique

--~--~---------~--~----~------------~-------~--~----~
You received this message from the "vim_dev" maillist.
For more information, visit http://www.vim.org/maillist.php
-~----------~----~----~----~------~----~------~--~---

Index: screen.c
===================================================================
RCS file: /cvsroot/vim/vim7/src/screen.c,v
retrieving revision 1.91
diff -c -r1.91 screen.c
*** screen.c    30 Jul 2007 20:00:27 -0000      1.91
--- screen.c    5 Aug 2007 01:36:08 -0000
***************
*** 2494,2499 ****
--- 2494,2502 ----
  
      /* Init to all spaces. */
      copy_spaces(p, (size_t)wp->w_p_fdc);
+ #if FEAT_MBYTE
+     p[wp->w_p_fdc] = NUL;
+ #endif
  
      level = win_foldinfo.fi_level;
      if (level > 0)

Raspunde prin e-mail lui