Skip to content

fix use-of-uninitialized-value in survive_kalman_tracker_stats#348

Merged
bl4ckb0ne merged 1 commit intocollabora:masterfrom
rocketmark:fix/uninit-integration-variance
Feb 17, 2026
Merged

fix use-of-uninitialized-value in survive_kalman_tracker_stats#348
bl4ckb0ne merged 1 commit intocollabora:masterfrom
rocketmark:fix/uninit-integration-variance

Conversation

@rocketmark
Copy link
Copy Markdown
Contributor

Summary

integration_variance[16] is stack-allocated without initialization in survive_kalman_tracker_stats(). variance_tracker_calc() calls scalend() which divides by meas->counts and writes meas->variance.size elements. If the tracker had zero observations (no pose or IMU data was ever integrated), counts is 0 and/or variance.size is 0 — so scalend either writes NaN/Inf or writes nothing, leaving the array uninitialized. The array is then read by SV_VERBOSE via LINMATH_VEC7_EXPAND / LINMATH_VEC6_EXPAND.

Found by MSan when running test_replays (replay data with a tracker that had no observations before survive_simple_close()).

MSan report
==5058==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 survive_kalman_tracker_stats survive_kalman_tracker.c:1490
#1 survive_kalman_tracker_free survive_kalman_tracker.c:1569
#2 survive_destroy_device survive_default_devices.c:699
#3 survive_close survive.c:1043
#4 survive_simple_close survive_api.c:339

Uninitialized value was created by an allocation of 'integration_variance'
#0 survive_kalman_tracker_stats survive_kalman_tracker.c:1488

Impact

Stats-only bug. The uninitialized values are only read for debug logging (SV_VERBOSE level 5). No effect on tracking, pose output, or calibration.

Change

One line in src/survive_kalman_tracker.c:

  • FLT integration_variance[16];
  • FLT integration_variance[16] = {0};

integration_variance[16] is stack-allocated but variance_tracker_calc()
may not write all elements when the tracker had zero observations
(counts == 0 or variance.size == 0). The uninitialized array is then
read by SV_VERBOSE via LINMATH_VEC7_EXPAND / LINMATH_VEC6_EXPAND.

Found by MSan when running test_replays.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@bl4ckb0ne bl4ckb0ne merged commit 477688f into collabora:master Feb 17, 2026
2 of 4 checks passed
@bl4ckb0ne
Copy link
Copy Markdown
Collaborator

Thanks!

@rocketmark rocketmark deleted the fix/uninit-integration-variance branch February 17, 2026 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants