Tcl Source Code

View Ticket
Login
Ticket UUID: 49538c09c8d7e93ab4375a41023c6c293f01cb5e
Title: TclUnixWaitForFile: infinite wait reads uninitialized "now" and may return early
Type: Bug Created on: 2026-09-25 17:27:46
Submitter: serhiy.storchaka Assigned to:
Subsystem: 01. Notifier Severity: Minor
Priority: 5 Medium Last modified: 2026-09-25 17:39:09
Status: Open Closed by:
Resolution: None Closed on:
Version: 9.0.4, 9.1b1
Description:

In TclUnixWaitForFile() (unix/tclUnixNotfy.c) now is only assigned if timeout > 0, but the loop is

    do {
	...
	if (timeout < 0) {
	    continue;
	}
	now = Tcl_GetDayTime();
    } while (abortTime > now);

continue in a do-while jumps to the condition, so with timeout < 0 (wait forever), whenever poll() returns without a requested event (e.g. -1 with EINTR on a signal, or POLLNVAL), abortTime > now is evaluated with abortTime == 0 and an uninitialized now. Depending on the garbage value the function either waits again or returns 0 ("not ready") although the wait was infinite. GCC reports it as "'now' may be used uninitialized" (seen with gcc 8.3 on DragonFly and gcc 10.5 on NetBSD), although at the first use at line 595, which is guarded by timeout > 0.

WaitForConnect() in tclUnixSock.c calls it with -1 in a loop, which hides the early return there, but other callers (it is in the internal stubs table) are affected. 9.0 has the same loop (with Tcl_Time); 8.6 uses while (1) and is not affected.

User Comments:
serhiy.storchaka added on 2026-09-25 17:39:09:

Proposed fix in [65772037dd] (branch unix-waitforfile-infinite-wait): use while (1) with an explicit timeout check, as in the macOS version. New test event-13.9 interrupts an infinite wait with testalarm; without the fix the wait returns early.