[splint-discuss] How to check Uninitialized variable

[Michael Wojcik]

> From: splint-discuss-bounces at cs.virginia.edu [mailto:splint-discuss-
> bounces at cs.virginia.edu] On Behalf Of Aaron Davies
> Sent: Tuesday, 12 May, 2009 10:28
> 
> On Tue, May 12, 2009 at 9:39 PM, Ludolf Holzheid <lholzheid at bihl-
> wiedemann.de> wrote:
> > On Tue, 2009-05-12 15:16:03 +0200, Nido wrote:
> >> Here's a hack I used for another project
> >>
> >> /* Yes this is meant to be uninitialised */ unsigned int seed =
> >> (unsigned int)&seed;
> >
> > Maybe you meant `seed' to be un-initialized, but you actually
> > initialized it to `some arbitrary number not equal to zero'. The
same
> > could be achieved with e.g. "unsigned int seed = 17;".
> 
> Isn't it non-deterministic though? Given the name, I assume that's
what
> he was trying to achieve.

It may be non-deterministic, depending on the execution environment - C
makes no guarantees either way. But it's unlikely to have much, if any,
entropy.

Nido's example is unclear: we don't know if this object has automatic or
static storage duration. In Vijayendra's example, the object was
automatic but in main(), so it probably doesn't matter, since relatively
few C programs call main recursively. So the address is likely fixed at
startup.

Even for an automatic variable, the number of call paths entering most
functions is fairly small, and there's little non-determinism in
consumption of automatic storage.

Most hosted C implementations these days run in virtual-memory
environments, so objects with static storage duration are typically at
fixed virtual addresses, and objects with automatic storage are
typically offset from a fixed base.

Consequently, the address of an object can often be predicted as a
member of a fairly small subset of possible addresses with good
probability.

Whether such an address is likely to have more or less entropy than the
contents of an uninitialized automatic variable depends on
implementation, environment, and runtime behavior. But neither is a good
source of entropy.

-- 
Michael Wojcik
Principal Software Systems Developer, Micro Focus