Valgrind: conditional jump or move depends on uninitialised value

Question

I have the following c file named main.c:

#include <stdio.h>
#include <string.h>

#define NUM_CHAR 20

int main(void) {
    char command_line[NUM_CHAR + 2]; /* Command line string includes the new line character ('\n') and a null character ('\0')  */
    while (1) {
        if (fgets(command_line, sizeof(command_line), stdin) == NULL) { /*This function reads up to sizeof(command_line)-1 characters, or until it encounters the new line character. The function adds '\0' to the end of the array */
            perror("Error: standard function fgets has failed");
            break;
        }

        if (command_line[sizeof(command_line) - 2] != '\n' && strlen(
                command_line) == NUM_CHAR + 1) { /*# of characters (excluding '\n') in command_line is <=num_char iff the condition takes place. */
            printf(
                    "Error: command length must be less than or equal     to %d characters\n",
                NUM_CHAR);
        while (getchar() != '\n') {
        } /* read the remaining characters */
        continue;/* continue with  while(1) loop */
        }

        printf("%s",command_line);

        if (command_line[0] == 'Q') {
            break;
        }
    }
  return 0;
}

a text file named input with the following line:

 Quit

This is what I got after running valgrind in the terminal (the name of the program is also main):

student@student-VirtualBox:~/workspace/tests$ valgrind --track-origins=yes --leak-check=full ./main < input
==2649== Memcheck, a memory error detector
==2649== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==2649== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==2649== Command: ./main
==2649== 
==2649== Conditional jump or move depends on uninitialised value(s)
==2649==    at 0x8048542: main (in /home/student/workspace/tests/main)
==2649==  Uninitialised value was created by a stack allocation
==2649==    at 0x80484FA: main (in /home/student/workspace/tests/main)
==2649== 
Quit
==2649== 
==2649== HEAP SUMMARY:
==2649==     in use at exit: 0 bytes in 0 blocks
==2649==   total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==2649== 
==2649== All heap blocks were freed -- no leaks are possible
==2649== 
==2649== For counts of detected and suppressed errors, rerun with: -v
==2649== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 11 from 6)

By the way, I compiled this code with optimizations OFF (-O0). I have 2 questions:

What is the cause for the error: Conditional jump or move depends on uninitialised value(s) ?

Why doesn't valgrind show the line number of the line that caused this error ?

If you'd still like to know why valgrind didn't report a line number, can you post the full command line you passed to gcc? At a guess, you might be missing -g — simonc

simonc simonc · Accepted Answer · 2013-08-03T11:22:18

There is no guarantee that fgets will write exactly sizeof(command_line) bytes to command_line. If the user types a shorter string, checking

command_line[sizeof(command_line) - 2] != '\n'

will read a part of command_line that wasn't initialised by your code or written to by fgets.

There are a couple of ways you could fix this.

You could test strlen first before dereferencing the end of command_line

if (strlen(command_line) == NUM_CHAR + 1 &&
    command_line[sizeof(command_line) - 2] != '\n')

or you could initialise all of command_line when you declare it

char command_line[NUM_CHAR + 2];
memset(command_line, 0, sizeof(command_line));

Valgrind: conditional jump or move depends on uninitialised value

1 Answers