<p>An uninitialized read is when a variable is created without an initial value and then the value of this variable is read. This should be avoided as the resulting behavior is unpredictable and could be different each time the program is run. According to <a href="https://en.cppreference.com/book/uninitialized" rel="nofollow noreferrer">cppreference.com</a>:</p>
<blockquote>
<p>Normally uninitialized variables are a bad idea, and the only place where they are useful is when you are about to read the variable in from some input stream.</p>
</blockquote>
<p>There are various tools for detecting uninitialized reads, some of which were covered in this Bitcoin Core PR review club <a href="https://bitcoincore.reviews/17639" rel="nofollow noreferrer">session</a> in December 2019.</p>
<p>These include dynamic analysis tools such as <a href="https://clang.llvm.org/docs/MemorySanitizer.html" rel="nofollow noreferrer">MemorySanitizer</a> (MSan), Valgrind (specifically <a href="https://www.cprogramming.com/debugging/valgrind.html" rel="nofollow noreferrer">Memcheck</a>) and static analysis tools that examine the code without running it.</p>
<p>Uninitialized reads can also be found through unit, functional or fuzz tests, by compiling with the <code>-Werror=uninitialized</code> flag or compiling with Clang with the <code>-ftrivial-auto-var-init=pattern</code> flag which will pre-initialize variables with dummy values.</p>
<p><strong>History of detected uninitialized reads in Bitcoin Core</strong></p>
<p>The most recently detected uninitialized read at the time of writing (October 2020) was found by Marco Falke in the recently merged Signet <a href="https://github.com/bitcoin/bitcoin/pull/20035" rel="nofollow noreferrer">code</a>. He found it through visual review and it was caught before it made it into a major Bitcoin Core release.</p>
<p>As practicalswift <a href="https://github.com/bitcoin/bitcoin/pull/20035#issuecomment-702248040" rel="nofollow noreferrer">highlights</a>, there have been a number of examples of uninitialized reads found in recent years but with more widespread usage of sophisticated tools these are likely to be found with decreasing frequency.</p>
<p>2020: <a href="https://github.com/bitcoin/bitcoin/pull/18261#issuecomment-596803815" rel="nofollow noreferrer">Use of uninitialized memory in Erlay networking code</a> - found pre-merge</p>
<p>2020: <a href="https://github.com/bitcoin/bitcoin/pull/18242#issuecomment-593674721" rel="nofollow noreferrer">Use of uninitialized memory in BIP324 encrypted p2p transport de-/serializer code</a> (truth in advertising: I haven't verified this one by writing a PoC) - found pre-merge</p>
<p>2020: <a href="https://github.com/bitcoin/bitcoin/pull/18162" rel="nofollow noreferrer">util: Avoid potential uninitialized read in FormatISO8601DateTime(int64_t) by checking gmtime_s/gmtime_r return</a></p>
<p>2019: <a href="https://github.com/bitcoin/bitcoin/pull/17624" rel="nofollow noreferrer">Use of uninitialized memory in networking code when receiving a transaction we already have</a> - found post-merge</p>
<p>2019: <a href="https://github.com/bitcoin/bitcoin/issues/17642" rel="nofollow noreferrer">wallet: Uninitialized read in bumpfee(…)</a></p>
<p>2018: <a href="https://github.com/bitcoin/bitcoin/pull/13712" rel="nofollow noreferrer">wallet: Fix non-determinism in ParseHDKeypath(...). Avoid using an uninitialized variable in path calculation.</a></p>
<p>2018: <a href="https://github.com/bitcoin/bitcoin/pull/13546" rel="nofollow noreferrer">wallet: Fix use of uninitialized value bnb_used in CWallet::CreateTransaction(...)</a></p>
<p>2017: <a href="https://github.com/bitcoin/bitcoin/pull/10977" rel="nofollow noreferrer">[net] Fix use of uninitialized value in getnetworkinfo(const JSONRPCRequest&amp;)</a></p>
<p>2017: <a href="https://github.com/bitcoin/bitcoin/pull/9555" rel="nofollow noreferrer">[test] Avoid reading a potentially uninitialized variable in tx_invalid-test (transaction_tests.cpp)</a></p>

CC BY-SA 4.0
2020-10-02T18:35:56.550Z
2020-10-03T13:41:49.173Z
2020-10-03T13:41:49.173Z
Michael Folkson
<p>What is an uninitialized read? Can you point out some examples found in Bitcoin Core? How do you detect them?</p>

CC BY-SA 4.0
2020-10-12T10:18:26.637Z
An uninitialized read happens when your program logic depends on a variable value, which is defined by uninitialized memory (ie your program did not give it semantic and if it uses it anyway, its behaviour will depend on whatever garbage there is in memory at this location at runtime). That said, it seems to be more of a programming question better directed at stackoverflow or a programming stackexchange ?
Antoine Poinsot
CC BY-SA 4.0
2020-10-12T10:19:16.980Z
I’m voting to close this question because i think it is a general programing question (see previous comment left).
Antoine Poinsot
CC BY-SA 4.0
2020-10-12T10:24:00.337Z
Can you point out some examples found in Bitcoin Core and how to detect them is a general programming question? There is programming in Bitcoin. This is not the place for Bitcoin programming questions?
Michael Folkson
CC BY-SA 4.0
2020-10-12T10:27:34.943Z
By this logic Bitcoin cryptography questions should be in the Cryptography StackExchange, Bitcoin programming questions should be in the Programming StackExchange, Bitcoin security questions should be in the Security StackExchange. I think it is nonsense.
Michael Folkson
CC BY-SA 4.0
2020-10-12T11:55:08.017Z
"This is not the place for Bitcoin programming questions?" => I don't know to be honest, was just a personal feeling :) It appeared in my "close votes" queue, i didn't see you already added an answer 10 days ago !
Antoine Poinsot
<security><bitcoin-core-development><testing><bitcoincore-review>
What is an uninitialized read? Can you point out some examples found in Bitcoin Core? How do you detect them?
Michael Folkson
# What is an uninitialized read? Can you point out some examples found in Bitcoin Core? How do you detect them?

(Asked by: username_0 on 2020-10-02)

What is an uninitialized read? Can you point out some examples found in Bitcoin Core? How do you detect them?

**Tags:** security, bitcoin-core-development, testing, bitcoincore-review

> **Comments:**
> **username_1**: An uninitialized read happens when your program logic depends on a variable value, which is defined by uninitialized memory (ie your program did not give it semantic and if it uses it anyway, its behaviour will depend on whatever garbage there is in memory at this location at runtime). That said, it seems to be more of a programming question better directed at stackoverflow or a programming stackexchange ?  
> **username_1**: I’m voting to close this question because i think it is a general programing question (see previous comment left).  
> **username_0**: Can you point out some examples found in Bitcoin Core and how to detect them is a general programming question? There is programming in Bitcoin. This is not the place for Bitcoin programming questions?  
> **username_0**: By this logic Bitcoin cryptography questions should be in the Cryptography StackExchange, Bitcoin programming questions should be in the Programming StackExchange, Bitcoin security questions should be in the Security StackExchange. I think it is nonsense.  
> **username_1**: "This is not the place for Bitcoin programming questions?" => I don't know to be honest, was just a personal feeling :) It appeared in my "close votes" queue, i didn't see you already added an answer 10 days ago !  

---

## 1 answers

### Answer by username_0 on 2020-10-02. Score: 2 | Accepted answer

An uninitialized read is when a variable is created without an initial value and then the value of this variable is read. This should be avoided as the resulting behavior is unpredictable and could be different each time the program is run. According to [cppreference.com](https://en.cppreference.com/book/uninitialized):

> Normally uninitialized variables are a bad idea, and the only place where they are useful is when you are about to read the variable in from some input stream.

There are various tools for detecting uninitialized reads, some of which were covered in this Bitcoin Core PR review club [session](https://bitcoincore.reviews/17639) in December 2019.

These include dynamic analysis tools such as [MemorySanitizer](https://clang.llvm.org/docs/MemorySanitizer.html) (MSan), Valgrind (specifically [Memcheck](https://www.cprogramming.com/debugging/valgrind.html)) and static analysis tools that examine the code without running it.

Uninitialized reads can also be found through unit, functional or fuzz tests, by compiling with the `-Werror=uninitialized` flag or compiling with Clang with the `-ftrivial-auto-var-init=pattern` flag which will pre-initialize variables with dummy values.

**History of detected uninitialized reads in Bitcoin Core**

The most recently detected uninitialized read at the time of writing (October 2020) was found by Marco Falke in the recently merged Signet [code](https://github.com/bitcoin/bitcoin/pull/20035). He found it through visual review and it was caught before it made it into a major Bitcoin Core release.

As practicalswift [highlights](https://github.com/bitcoin/bitcoin/pull/20035#issuecomment-702248040), there have been a number of examples of uninitialized reads found in recent years but with more widespread usage of sophisticated tools these are likely to be found with decreasing frequency.

2020: [Use of uninitialized memory in Erlay networking code](https://github.com/bitcoin/bitcoin/pull/18261#issuecomment-596803815) - found pre-merge

2020: [Use of uninitialized memory in BIP324 encrypted p2p transport de-/serializer code](https://github.com/bitcoin/bitcoin/pull/18242#issuecomment-593674721) (truth in advertising: I haven't verified this one by writing a PoC) - found pre-merge

2020: [util: Avoid potential uninitialized read in FormatISO8601DateTime(int64\_t) by checking gmtime\_s/gmtime\_r return](https://github.com/bitcoin/bitcoin/pull/18162)

2019: [Use of uninitialized memory in networking code when receiving a transaction we already have](https://github.com/bitcoin/bitcoin/pull/17624) - found post-merge

2019: [wallet: Uninitialized read in bumpfee(…)](https://github.com/bitcoin/bitcoin/issues/17642)

2018: [wallet: Fix non-determinism in ParseHDKeypath(...). Avoid using an uninitialized variable in path calculation.](https://github.com/bitcoin/bitcoin/pull/13712)

2018: [wallet: Fix use of uninitialized value bnb\_used in CWallet::CreateTransaction(...)](https://github.com/bitcoin/bitcoin/pull/13546)

2017: [[net] Fix use of uninitialized value in getnetworkinfo(const JSONRPCRequest&)](https://github.com/bitcoin/bitcoin/pull/10977)

2017: [[test] Avoid reading a potentially uninitialized variable in tx\_invalid-test (transaction\_tests.cpp)](https://github.com/bitcoin/bitcoin/pull/9555)


---

