Possible uninitialized read in decompress_blob_lz4 #12825
Description
Yet another (possible) issue found by MemorySanitizer.
Uninitialized bytes in __interceptor_memcmp at offset 0 inside [0x734000000000, 120052)
==21757==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x499691 in test_compress_decompress /home/fsumsal/repos/systemd/build/../src/journal/test-compress-benchmark.c:124:17
#1 0x495d12 in main /home/fsumsal/repos/systemd/build/../src/journal/test-compress-benchmark.c:169:17
#2 0x7ff8d794bf32 in __libc_start_main (/lib64/libc.so.6+0x23f32)
#3 0x41c3bd in _start (/home/fsumsal/repos/systemd/build/test-compress-benchmark+0x41c3bd)
Uninitialized value was created by a heap allocation
#0 0x425193 in realloc (/home/fsumsal/repos/systemd/build/test-compress-benchmark+0x425193)
#1 0x7ff8d8fccb30 in decompress_blob_lz4 /home/fsumsal/repos/systemd/build/../src/journal/compress.c:194:23
#2 0x4991fd in test_compress_decompress /home/fsumsal/repos/systemd/build/../src/journal/test-compress-benchmark.c:119:21
#3 0x495d12 in main /home/fsumsal/repos/systemd/build/../src/journal/test-compress-benchmark.c:169:17
#4 0x7ff8d794bf32 in __libc_start_main (/lib64/libc.so.6+0x23f32)
SUMMARY: MemorySanitizer: use-of-uninitialized-value /home/fsumsal/repos/systemd/build/../src/journal/test-compress-benchmark.c:124:17 in test_compress_decompress
Exiting
The issue itself is caused by passing dst_alloc_size = 0 (in this particular case) to decompress_blob_lz4() which then calls realloc(), where the new memory blob is treated as uninitialized by MSan.
https://github.com/systemd/systemd/blob/master/src/journal/compress.c#L193-L198
I'm not sure if this is a real issue here, as the uninitialized memory should get initialized later by the LZ4_decompress_safe() function, so it's possible MSan is just confused (which could be solved by msan_unpoison()); calling memset/memzero on the new memory blob makes MSan happy though.