Memory Sanitizer

Question

I am playing around with Memory Sanitizer with Clang 3.7.0 on Ubuntu 14.04. The following code does work perfectly:

#include <cstdio>

int main() {
  double ans;
  printf("Hello World: %f\n", ans);

  return 0;
}

when compiled with

 clang++ -g -O1 -fsanitize=memory -fsanitize-memory-track-origins=2 -fomit-frame-pointer sanitize.cpp -o sanitize

I was expecting an error. Doesn't Memory Sanitizer catch the fact that ans was not initialized?

Thanks for your help.

I'm surprised the compiler itself doesn't complain. I know the compiler can't catch every case like this with static analysis, but it should be able to catch simplistic ones like this. — Adrian McCarthy, Dec 07 '15 at 22:09
@AdrianMcCarthy Both GCC and Clang *do* complain *if* you switch on the warnings (using for example `-Wall`, this particular one is controlled by `-Wuninitialized`), which OP did not do. — Ilya Popov, Dec 08 '15 at 01:05
@IlyaPopov: With VC++, this code generates an error rather than an ignorable, off-by-default warning. — Adrian McCarthy, Dec 08 '15 at 18:51

score 7 · Accepted Answer · answered Dec 07 '15 at 19:13

7

From the clang santitizer documentation it is clear that it only deals with unitialized memory reads from dynamically allocated memory. Automatic memory is not part of sanitizer checks.

answered Dec 07 '15 at 19:13

SergeyA

61,605
5
78
137

Thanks. I understand now that my question was stupid as this kind of check can be made statically. – InsideLoop Dec 08 '15 at 09:37

score 1 · Answer 2 · answered Dec 07 '15 at 19:31

Valgrind memcheck could be an option to detect the uninitialized stack values.

Valgrind documentation:

For uninitialised values originating from a heap block, Memcheck shows where the block was allocated. For uninitialised values originating from a stack allocation, Memcheck can tell you which function allocated the value, but no more than that -- typically it shows you the source location of the opening brace of the function. So you should carefully check that all of the function's local variables are initialised properly.

Reference: http://valgrind.org/docs/manual/mc-manual.html

score 1 · Answer 3 · answered Dec 08 '15 at 01:14

You don't need any Sanitizer to catch this error. The compiler can figure out this error in compile time (sanitizers and valgrind work at run time). In fact, all of GCC Clang and ICC will all give a warning for this code if you switch on the warnings. This particular warning is controlled with -Wuninitialized flag. In general, it is a good practice to always use high warning level. I would recommend the following combination of warning flags, especially while learning the language:

-Wall -Wextra -pedantic

If you get some false positives, only after rigorously checking that they are really false, you can disable specific warnings. There is no reason not to use warning flags. Some projects even use -Werror flag, turning all the warnings into errors.

Memory Sanitizer

3 Answers3

Linked