false positive on WaitNamedPipeW

[mistmist]

DrMemory 1.9.0-4 reports a UNINITIALIZED READ on this call, despite the 2 in-parameters being constants:

https://msdn.microsoft.com/en-us/library/windows/desktop/aa365800%28v=vs.120%29.aspx

cl.exe -Zi foo4.cc kernel32.lib


#include <windows.h>

int main()
{
    BOOL ret = WaitNamedPipeW(L"\\\\.\\pipe\\doesnotexist", 1);
    return ret;
}

Running it with "drmemory.exe foo4.exe" on Windows 7:

Dr. Memory version 1.9.0 build 4 built on Oct  2 2015 13:13:14
Dr. Memory results for pid 3880: "foo4.exe"
Application cmdline: "foo4.exe"
Recorded 116 suppression(s) from default C:\Users\ms\DrMemory-Windows-1.9.0-4\bin\suppress-default.txt

Error #1: UNINITIALIZED READ: reading 0x00707a95-0x00707a96 1 byte(s) within 0x00707a88-0x00707aae
#0 system call NtFsControlFile parameter #6
#1 KERNELBASE.dll!WaitNamedPipeW                         +0x2c6    (0x753483cc <KERNELBASE.dll+0x83cc>)
#2 main                                                   [c:\cygwin\tmp\foo4.cc:7]
Note: @0:00:00.561 in thread 3904

Running it with "-light" reports no error.
"-debug -dr_debug -pause_at_assert" does not print anything interesting.

[zhaoqin]

Thanks for the issue reports, would you like to contribute patch to fix
those issues?
On Nov 27, 2015 7:47 AM, "mistmist" [email protected] wrote:

DrMemory 1.9.0-4 reports a UNINITIALIZED READ on this call, despite the 2
in-parameters being constants:

https://msdn.microsoft.com/en-us/library/windows/desktop/aa365800%28v=vs.120%29.aspx

cl.exe -Zi foo4.cc kernel32.lib

#include <windows.h>

int main()
{
BOOL ret = WaitNamedPipeW(L"\.\pipe\doesnotexist", 1);
return ret;
}

Running it with "drmemory.exe foo4.exe" on Windows 7:

Dr. Memory version 1.9.0 build 4 built on Oct 2 2015 13:13:14
Dr. Memory results for pid 3880: "foo4.exe"
Application cmdline: "foo4.exe"
Recorded 116 suppression(s) from default C:\Users\ms\DrMemory-Windows-1.9.0-4\bin\suppress-default.txt

Error #1: UNINITIALIZED READ: reading 0x00707a95-0x00707a96 1 byte(s) within 0x00707a88-0x00707aae

0 system call NtFsControlFile parameter #6

1 KERNELBASE.dll!WaitNamedPipeW +0x2c6 (0x753483cc <KERNELBASE.dll+0x83cc>)

2 main [c:\cygwin\tmp\foo4.cc:7]

Note: @0:00:00.561 in thread 3904

Running it with "-light" reports no error.
"-debug -dr_debug -pause_at_assert" does not print anything interesting.

—
Reply to this email directly or view it on GitHub
#1827.

[derekbruening]

The relevant entry is here: https://github.com/DynamoRIO/drmemory/blob/master/drsyscall/table_windows_ntoskrnl.c#L920

Most likely there is some structure to the data and some field is sub-dword.

[derekbruening]

The structure is in ntifs.h:

// Control structure for FSCTL_PIPE_WAIT
typedef struct _FILE_PIPE_WAIT_FOR_BUFFER {
     LARGE_INTEGER Timeout;
     ULONG NameLength;
     BOOLEAN TimeoutSpecified;
     WCHAR Name[1];
} FILE_PIPE_WAIT_FOR_BUFFER, *PFILE_PIPE_WAIT_FOR_BUFFER;

The upper bytes of the BOOLEAN are what we're hitting here.