Question

When valgrind runs this program (implementing a simple type of data compression), it reports “Conditional jump depends on uninitialized value.” It also occasionally segfaults. Problem is, I can’t seem to pinpoint which variable is not initialized. My CS professor mentioned that “your code doesn’t make sure that the strings are properly null-terminated” but I can’t see where.

https://gist.github.com/anonymous/9f6c87fb33985606a297

(edit – added the actual code here:)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define WORDLIM 128
#define REPEAT for(;;)
struct word {
    char *cont;
    char *wsp;  
    int ctr;
}; 

char peekchar(void)
{
    char c;
    c = getchar();
    if(c != EOF) 
        ungetc(c, stdin);

    /* puts it back */    
    return c;
} 

struct word *getword()
{
    char cont[WORDLIM];
    char wsp[WORDLIM];
    cont[0] = '\0';
    wsp[0] = '\0';
    if (peekchar() == EOF) 
    {
        return NULL;
    }

    REPEAT{
        char c = getchar();
        char buf[2];
        buf[0]=c;
        buf[1]='\0';
        if (c == '\n' || c == ' ' || c == EOF)
        {
            if (c != EOF)
                strcat(wsp, buf);
            if (peekchar() != '\n' && peekchar() != ' ')
            {
                struct word *toret;
                toret = malloc(sizeof(struct word));
                toret->cont = malloc(strlen(cont) + 1);
                strcpy(toret->cont, cont);
                toret->wsp = malloc(strlen(wsp) + 1);
                strcpy(toret->wsp, wsp);
                toret->ctr = -1;
                return toret;
            }
            continue;
        }
        else {
            strcat(cont, buf);
            continue;
        }
    }
    printf("PANIC PANIC PANIC THIS IS GOING WROOOOONG!!!!!\n");
}

void numbrify(struct word **wordlist)
{
    int oc = 0;
    int roc = oc;
    struct word *w;
    while ((w = wordlist[oc]) != NULL){
        int ic;
        if (w->ctr == -1){
            for (ic = oc + 1; wordlist[ic] != NULL; ic++){
                if (!strcmp(wordlist[ic]->cont, w->cont)){
                    //printf("**found match between %s and %s**\n", wordlist[ic]->cont, w->cont);
                    wordlist[ic]->ctr = roc;
                }
            }
            if (w->cont[0]!='\0')
        roc++;
        }
        oc++;
    }
} 

int main(void){
    struct word *wlist[4096];
    int i = 0;
    struct word *w;
    for (i = 0; (w = getword()) != NULL; i++){
        wlist[i]=w;
    }

    wlist[i+1] = NULL;
    numbrify(wlist);
    i = 0;
    for (i = 0; wlist[i]!=NULL; i++){
        if (wlist[i]->ctr == -1) 
            printf("%s%s", wlist[i]->cont, wlist[i]->wsp);
        else 
            printf("%d%s", wlist[i]->ctr, wlist[i]->wsp);
            //printf("'%s'\t'%s'\t%d\n", wlist[i]->cont, wlist[i]->wsp, wlist[i]->ctr);
    }

    return 0;
}

Answer 1

At line 85 of your program:

wlist[i+1] = NULL;

i already points to an unused entry in the array, so assigning NULL to wlist[i+1] leaves an undefined value before the end.

I determined this by running the Clang static analyzer*, which identified this issue in the first two diagnostics (as well as an unrelated, harmless error as the third one):

14968829.c:62:12: warning: Assigned value is garbage or undefined
        while ((w = wordlist[oc]) != NULL){
                  ^ ~~~~~~~~~~~~
14968829.c:65:35: warning: The left operand of '!=' is a garbage value
                        for (ic = oc + 1; wordlist[ic] != NULL; ic++){
                                          ~~~~~~~~~~~~ ^
14968829.c:87:2: warning: Value stored to 'i' is never read
        i = 0;
        ^   ~

Correcting the issue (by changing wlist[i+1] to wlist[i]) caused the two Clang diagnostics to disappear, as well as the Valgrind errors.

*: Command line: clang --analyze -Wall 14968829.c -o 14968829