#1017426 libnss3: Uninitialised value was created by a stack allocation

Package:
libnss3
Source:
libnss3
Description:
Network Security Service libraries
Submitter:
Date:
2024-04-25 17:39:12 UTC
Severity:
normal
Tags:
#1017426#5
Date:
2022-08-16 05:30:07 UTC
From:
To:
Dear Maintainer,

debuging valgrind pidgin with result:

==804198==  Uninitialised value was created by a stack allocation
==804198==    at 0xB089DC0: ssl3_MACEncryptRecord (ssl3con.c:2104)

line correspopnds to the ssl3_MACEncryptRecord
#1017426#10
Date:
2022-08-16 05:59:43 UTC
From:
To:
Looking at the code, it would seem to be a false positive, but I might
have overlooked something, but you haven't pasted the most interesting
parts of the valgrind output...

Mike
#1017426#15
Date:
2022-08-16 06:06:20 UTC
From:
To:
This output comes exactly from valgrind. No usual stack trace. Before and
below are different issues.

BTW pidgin crashing sometimes, and only issues I can record points to the
nss library.
#1017426#20
Date:
2022-08-16 06:49:57 UTC
From:
To:
Usually, "Uninitialised value was created by a stack allocation" is the
reason for the error, with a stack trace, that comes above it. That's
the most crucial information. Without that, we don't know what is trying
to use that unitialized value.
#1017426#25
Date:
2022-08-16 06:59:30 UTC
From:
To:
 Ok .Let me restart pidgin. It 100% reproducible. Only thing you need is to
install dbgsym for glibc, nss3, pidgin and add frew irc and jabber accounts
(I also using matrix plugin). Command would be:

G_SLICE=always-malloc valgrind --num-callers=30 --track-origins=yes pidgin
2>&1 | tee 123.log

https://paste.debian.net/1250580/
#1017426#30
Date:
2022-08-16 07:17:16 UTC
From:
To:
Can you reproduce with 3.81-1 in unstable?

For posterity, the useful information:

==837133== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==837133==    at 0x5A153D6: __libc_send (send.c:28)
==837133==    by 0x5A153D6: send (send.c:23)
==837133==    by 0xB083527: pt_Send (ptio.c:2002)
==837133==    by 0xB01DFF7: ssl_DefSend (ssldef.c:105)
==837133==    by 0xB0229C0: ssl_SendSavedWriteData (sslsecur.c:452)
==837133==    by 0xB006839: ssl3_SendRecord (ssl3con.c:2568)
==837133==    by 0xB006C2C: ssl3_FlushHandshakeMessages (ssl3con.c:2774)
==837133==    by 0xB006C2C: ssl3_FlushHandshake (ssl3con.c:2747)
==837133==    by 0xB00F5E4: ssl3_SendFinished (ssl3con.c:11944)
==837133==    by 0xB00FB79: ssl3_SendClientSecondRound (ssl3con.c:8191)
==837133==    by 0xB011A7A: ssl3_HandleServerHelloDone (ssl3con.c:8061)
==837133==    by 0xB011A7A: ssl3_HandlePostHelloHandshakeMessage (ssl3con.c:12568)
==837133==    by 0xB011A7A: ssl3_HandleHandshakeMessage (ssl3con.c:12479)
==837133==    by 0xB014A74: ssl3_HandleHandshake (ssl3con.c:12653)
==837133==    by 0xB014A74: ssl3_HandleNonApplicationData (ssl3con.c:13188)
==837133==    by 0xB0153C0: ssl3_HandleRecord (ssl3con.c:13529)
==837133==    by 0xB01B500: ssl3_GatherCompleteHandshake (ssl3gthr.c:561)
==837133==    by 0xB01B500: ssl3_GatherCompleteHandshake (ssl3gthr.c:449)
==837133==    by 0xB022A80: SSL_ForceHandshake (sslsecur.c:382)
==837133==    by 0xADCC8D6: ssl_nss_handshake_cb (ssl-nss.c:371)
==837133==    by 0x1824B1: pidgin_io_invoke (gtkeventloop.c:73)
==837133==    by 0x54BBA9E: g_main_dispatch (gmain.c:3417)
==837133==    by 0x54BBA9E: g_main_context_dispatch (gmain.c:4135)
==837133==    by 0x54BBE57: g_main_context_iterate.constprop.0 (gmain.c:4211)
==837133==    by 0x54BC10E: g_main_loop_run (gmain.c:4411)
==837133==    by 0x4C57B29: gtk_main (in /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0.2400.33)
==837133==    by 0x145D7B: main (gtkmain.c:948)
==837133==  Address 0x1b82e246 is 534 bytes inside a block of size 1,553 alloc'd
==837133==    at 0x484582F: realloc (vg_replace_malloc.c:1437)
==837133==    by 0xB2114A1: PORT_Realloc_Util (secport.c:101)
==837133==    by 0xB01E1E4: sslBuffer_Grow (sslencode.c:50)
==837133==    by 0xB01E1E4: sslBuffer_Grow (sslencode.c:31)
==837133==    by 0xB01E42B: sslBuffer_Append (sslencode.c:82)
==837133==    by 0xB006817: ssl3_SendRecord (ssl3con.c:2559)
==837133==    by 0xB006C2C: ssl3_FlushHandshakeMessages (ssl3con.c:2774)
==837133==    by 0xB006C2C: ssl3_FlushHandshake (ssl3con.c:2747)
==837133==    by 0xB00F5E4: ssl3_SendFinished (ssl3con.c:11944)
==837133==    by 0xB00FB79: ssl3_SendClientSecondRound (ssl3con.c:8191)
==837133==    by 0xB011A7A: ssl3_HandleServerHelloDone (ssl3con.c:8061)
==837133==    by 0xB011A7A: ssl3_HandlePostHelloHandshakeMessage (ssl3con.c:12568)
==837133==    by 0xB011A7A: ssl3_HandleHandshakeMessage (ssl3con.c:12479)
==837133==    by 0xB014A74: ssl3_HandleHandshake (ssl3con.c:12653)
==837133==    by 0xB014A74: ssl3_HandleNonApplicationData (ssl3con.c:13188)
==837133==    by 0xB0153C0: ssl3_HandleRecord (ssl3con.c:13529)
==837133==    by 0xB01B500: ssl3_GatherCompleteHandshake (ssl3gthr.c:561)
==837133==    by 0xB01B500: ssl3_GatherCompleteHandshake (ssl3gthr.c:449)
==837133==    by 0xB022A80: SSL_ForceHandshake (sslsecur.c:382)
==837133==    by 0xADCC8D6: ssl_nss_handshake_cb (ssl-nss.c:371)
==837133==    by 0x1824B1: pidgin_io_invoke (gtkeventloop.c:73)
==837133==    by 0x54BBA9E: g_main_dispatch (gmain.c:3417)
==837133==    by 0x54BBA9E: g_main_context_dispatch (gmain.c:4135)
==837133==    by 0x54BBE57: g_main_context_iterate.constprop.0 (gmain.c:4211)
==837133==    by 0x54BC10E: g_main_loop_run (gmain.c:4411)
==837133==    by 0x4C57B29: gtk_main (in /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0.2400.33)
==837133==    by 0x145D7B: main (gtkmain.c:948)
==837133==  Uninitialised value was created by a stack allocation
==837133==    at 0xB005DC0: ssl3_MACEncryptRecord (ssl3con.c:2104)
#1017426#35
Date:
2022-08-16 07:32:55 UTC
From:
To:
Oh, I didn't know this is related. So, nice to know. I am able to reproduce
the same error log for 3.81-1, unfortunately I do not know how to install
debsym for unstable.

Full log with gtk issues:

https://paste.debian.net/1250584/