Bug 235931

Summary: [libpas] get_num_free_bytes_for_each_heap_callback() is called with `arg` pointing to uninitialized stack memory
Product: WebKit Reporter: David Kilzer (:ddkilzer) <ddkilzer>
Component: bmallocAssignee: David Kilzer (:ddkilzer) <ddkilzer>
Status: RESOLVED FIXED    
Severity: Normal CC: fpizlo, ggaren, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: Other   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch v1 none

Description David Kilzer (:ddkilzer) 2022-01-31 17:26:34 PST 
In libpas, get_num_free_bytes_for_each_heap_callback() is called with `arg` pointing to uninitialized stack memory.

pas_all_heaps_get_num_free_bytes() is called and doesn't initialize `result` on the stack, then calls the following functions with a pointer to `result`:
- pas_all_heaps_for_each_heap(), 
- pas_all_heaps_for_each_static_heap(), 
- callback() / get_num_free_bytes_for_each_heap_callback().

Found by clang static analyzer.
Comment 1 Radar WebKit Bug Importer 2022-01-31 17:26:59 PST 
<rdar://problem/88303899>
Comment 2 David Kilzer (:ddkilzer) 2022-01-31 17:28:47 PST 
Created attachment 450482 [details]
Patch v1
Comment 3 Yusuke Suzuki 2022-01-31 17:43:08 PST 
Comment on attachment 450482 [details]
Patch v1

r=me
Comment 4 EWS 2022-01-31 20:33:58 PST 
Committed r288866 (246618@main): <https://commits.webkit.org/246618@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 450482 [details].