Type < 0
ItemSize
space in the snap but only end up incrementing data by ItemSize/4
?if(RangeCheck(pEnd, pData, ItemSize) || ItemSize < 0) return -3;
Range check checks whether we have ItemSize
bytes left in the snappData += ItemSize/4;
-fsanitize=undefined
is also a godsend-fsanitize=memory
[vagrant@archlinux cross]$ ./DDNet-Server "sv_register 0"
[2020-06-13 13:44:03][engine]: running on unix-linux-amd64
[2020-06-13 13:44:03][engine]: arch is little endian
Uninitialized bytes in __interceptor_fwrite at offset 0 inside [0x7f9b4d71fe50, 112)
==8666==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x560f435119ba in io_write /vagrant/ddnet/cross/../src/base/system.c:341:9
#1 0x560f435119ba in aio_thread /vagrant/ddnet/cross/../src/base/system.c:483:3
#2 0x560f435135ac in thread_run /vagrant/ddnet/cross/../src/base/system.c:697:2
#3 0x7f9b4fdd1421 in start_thread (/usr/lib/libpthread.so.0+0x9421)
#4 0x7f9b4fcdebf2 in clone (/usr/lib/libc.so.6+0xffbf2)
SUMMARY: MemorySanitizer: use-of-uninitialized-value /vagrant/ddnet/cross/../src/base/system.c:341:9 in io_write
Exiting
==8666==WARNING: MemorySanitizer: use-of-uninitialized-value
[0x7f9b4d71fe50, 112)
-O3
(?) or -O2
CMAKE_BUILD_TYPE
in CMakeLists.txt or build with -DDEV=ON
or -DCMAKE_BUILD_TYPE=Debug
-DCMAKE_C_FLAGS_DEBUG
helped-O1
with clang -fsanitize=memory
?-fno-optimize-sibling-calls
CFLAGS="-fsanitize=memory -fno-optimize-sibling-calls" CXXFLAGS="-fsanitize=memory -fno-optimize-sibling-calls" LDFLAGS="-fsanitize=memory" CC="clang" CXX="clang++" cmake -GNinja -DCLIENT=OFF -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_FLAGS_DEBUG="-g -O1" -DCMAKE_CXX_FLAGS_DEBUG="-g -O1" ..
-g -O1
so 3 uninitialized uses../src/game/collision.cpp:902:247: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare]
if(m_pDoor[TileOnTheRight].m_Index == TILE_STOPA || m_pDoor[TileOnTheLeft].m_Index == TILE_STOPA || ((m_pDoor[TileOnTheRight].m_Index == TILE_STOPS || m_pDoor[TileOnTheLeft].m_Index == TILE_STOPS) && m_pDoor[TileOnTheRight].m_Flags|ROTATION_270|ROTATION_90))
-fsanitize-memory-track-origins=2
Uninitialized value was created by an allocation of 'retval' in the stack frame of function 'md5_finish'