julius-speech / julius

Open-Source Large Vocabulary Continuous Speech Recognition Engine
BSD 3-Clause "New" or "Revised" License
1.84k stars 300 forks source link

Access of uninitalized variable due to use of goto exit path search_bestfirst_v1.c#L897 #147

Closed dlmiles closed 4 years ago

dlmiles commented 4 years ago

This goto here:

https://github.com/julius-speech/julius/blob/master/libjulius/src/search_bestfirst_v1.c#L897

Is jumping to code that accesses the local variable endt (then maybe tn), but these variables are not initialized until after the goto:

https://github.com/julius-speech/julius/blob/master/libjulius/src/search_bestfirst_v1.c#L966 https://github.com/julius-speech/julius/blob/master/libjulius/src/search_bestfirst_v1.c#L914

Maybe initialize endt=-1 and modify https://github.com/julius-speech/julius/blob/master/libjulius/src/search_bestfirst_v1.c#L1280 from "} else {" into "} else if (endt != -1) {"

Maybe there are other local variables used below the "end_of_scan:" label that also want to be checked/initialized.

MSVC is finding that this execution path does happen, resulting in an uninitialized local variable being read before it was initialized (written to)

You should be able to prove this by setting endt to a magic value (maybe -1 will do or 0xdeadbeef) and jlog() before the goto proving it had the magic value before the jump to the label. Maybe it was not a problem before because most of the time endt will initialize to a non-zero value, resulting the safer L1280 else value being taken.

dlmiles commented 4 years ago

My report looks to be a dupe of https://github.com/julius-speech/julius/issues/47

LeeAkinobu commented 4 years ago

Thanks for your comment. This has been fixed on recent commit 4182bf024872cf4ff4388475359d74695dd5ee16