SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Uninitialized variable</title>

</head>

Uninitialized variable

</h1>

</header>

In <a href="Computing" title="Computing">computing</a>, an uninitialized variable is a <a href="Variable_(programming)" class="mw-redirect" title="Variable (programming)">variable</a> that is declared but is not set to a definite known value before it is used. It will have some value, but not a predictable one. As such, it is a programming error and a common source of <a href="Computer_bug" class="mw-redirect" title="Computer bug">bugs</a> in software.

<div class="mw-heading mw-heading2"><h2 id="Example_of_the_C_language">Example of the C language</h2></div>

A common assumption made by novice programmers is that all variables are set to a known value, such as zero, when they are declared. While this is true for many languages, it is not true for all of them, and so the potential for error is there. Languages such as <a href="C_(programming_language)" title="C (programming language)">C</a> use <a href="Stack_(data_structure)" class="mw-redirect" title="Stack (data structure)">stack</a> space for variables, and the collection of variables allocated for a subroutine is known as a <a href="Stack_frame" class="mw-redirect" title="Stack frame">stack frame</a>. While the computer will set aside the appropriate amount of space for the stack frame, it usually does so simply by adjusting the value of the stack <a href="Pointer_(computer_programming)" title="Pointer (computer programming)">pointer</a>, and does not set the <a href="Computer_storage" class="mw-redirect" title="Computer storage">memory</a> itself to any new state (typically out of efficiency concerns). Therefore, whatever contents of that memory at the time will appear as initial values of the variables which occupy those addresses.

Here's a simple example in C:

<div class="mw-highlight mw-highlight-lang-c mw-content-ltr" dir="ltr"><pre>void count(void)

{

int k;

for (int i = 0; i < 10; i++)

{

k = k + 1;

}

printf("%d", k);

}

</pre></div>

The final value of <code>k</code> is undefined. The answer that it must be 10 assumes that it started at zero, which may or may not be true. Note that in the example, the variable <code>i</code> is initialized to zero by the first clause of the <code>for</code> statement.

Another example can be when dealing with <a href="Struct" class="mw-redirect" title="Struct">structs</a>. In the code snippet below, we have a <code>struct student</code> which contains some variables describing the information about a student. The function <code>register_student</code> leaks memory contents because it fails to fully initialize the members of <code>struct student new_student</code>. If we take a closer look, in the beginning, <code>age</code>, <code>semester</code> and <code>student_number</code> are initialized. But the initialization of the <code>first_name</code> and <code>last_name</code> members are incorrect. This is because if the length of <code>first_name</code> and <code>last_name</code> character arrays are less than 16 bytes, during the <code>strcpy</code>,<a href="#cite_note-Man7_strcpy-1">[1]</a> we fail to fully initialize the entire 16 bytes of memory reserved for each of these members. Hence after <code>memcpy()</code>'ing the resulted struct to <code>output</code>,<a href="#cite_note-Man7_memcpy-2">[2]</a> we leak some stack memory to the caller.

<div class="mw-highlight mw-highlight-lang-c mw-content-ltr" dir="ltr"><pre>struct student {

unsigned int age;

unsigned int semester;

char first_name[16];

char last_name[16];

unsigned int student_number;

};

int register_student(struct student *output, int age, char *first_name, char *last_name)

{

// If any of these pointers are Null, we fail.

if (!output || !first_name || !last_name)

{

printf("Error!\n");

return -1;

}

// We make sure the length of the strings are less than 16 bytes (including the null-byte)

// in order to avoid overflows

if (strlen(first_name) > 15 || strlen(last_name) > 15) {

printf("first_name and last_name cannot be longer than 16 characters!\n");

return -1;

}

// Initializing the members

struct student new_student;

new_student.age = age;

new_student.semester = 1;

new_student.student_number = get_new_student_number();

strcpy(new_student.first_name, first_name);

strcpy(new_student.last_name, last_name);

//copying the result to output

memcpy(output, &new_student, sizeof(struct student));

return 0;

}

</pre></div>

In any case, even when a variable is implicitly initialized to a default value like 0, this is typically not the correct value. Initialized does not mean correct if the value is a default one. (However, default initialization to <a href="Null_pointer" title="Null pointer">0</a> is a right practice for pointers and arrays of pointers, since it makes them invalid before they are actually initialized to their correct value.) In C, variables with static storage duration that are not initialized explicitly are initialized to zero (or null, for pointers).<a href="#cite_note-ISO9899-3">[3]</a>

Not only are uninitialized variables a frequent cause of bugs, but this kind of bug is particularly serious because it may not be reproducible: for instance, a variable may remain uninitialized only in some <a href="Conditional_(computer_programming)" title="Conditional (computer programming)">branch</a> of the program. In some cases, programs with uninitialized variables may even pass <a href="Software_quality_assurance" title="Software quality assurance">software tests</a>.

<div class="mw-heading mw-heading2"><h2 id="Impacts">Impacts</h2></div>

Uninitialized variables are powerful bugs since they can be exploited to leak arbitrary memory or to achieve arbitrary memory overwrite or to gain code execution, depending on the case. When exploiting a software which utilizes <a href="Address_space_layout_randomization" title="Address space layout randomization">address space layout randomization</a> (ASLR), it is often required to know the <a href="Base_address" title="Base address">base address</a> of the software in memory. Exploiting an uninitialized variable in a way to force the software to leak a pointer from its <a href="Address_space" title="Address space">address space</a> can be used to bypass ASLR.

<div class="mw-heading mw-heading2"><h2 id="Use_in_languages">Use in languages</h2></div>

Uninitialized variables are a particular problem in languages such as assembly language, C, and <a href="C%2B%2B" title="C++">C++</a>, which were designed for <a href="Systems_programming" title="Systems programming">systems programming</a>. The development of these languages involved a design philosophy in which conflicts between performance and safety were generally resolved in favor of performance. The programmer was given the burden of being aware of dangerous issues such as uninitialized variables.

In other languages, variables are often initialized to known values when created. Examples include:

<ul><li><a href="VHDL" title="VHDL">VHDL</a> initializes all standard variables into special 'U' value. It is used in simulation, for debugging, to let the user to know when the <a href="Don't_care" class="mw-redirect" title="Don't care">don't care</a> initial values, through the <a href="Multi-valued_logic" class="mw-redirect" title="Multi-valued logic">multi-valued logic</a>, affect the output.</li>

<li><a href="Java_(programming_language)" title="Java (programming language)">Java</a> does not have uninitialized variables. Fields of classes and objects that do not have an explicit initializer and elements of arrays are automatically initialized with the default value for their type (false for boolean, 0 for all numerical types, null for all reference types).<a href="#cite_note-Java-4">[4]</a> Local variables in Java must be definitely assigned to before they are accessed, or it is a compile error.</li>

<li><a href="Python_(programming_language)" title="Python (programming language)">Python</a> initializes local variables to <code>NULL</code> (distinct from <code>None</code>) and raises an <code>UnboundLocalError</code> when such a variable is accessed before being (re)initialized to a valid value.</li>

<li><a href="D_(programming_language)" title="D (programming language)">D</a> initializes all variables unless explicitly specified by the programmer not to.</li></ul>

Even in languages where uninitialized variables are allowed, many <a href="Compiler" title="Compiler">compilers</a> will attempt to identify the use of uninitialized variables and report them as <a href="Compile-time" class="mw-redirect" title="Compile-time">compile-time</a> <a href="Compilation_error" title="Compilation error">errors</a>. Some languages assist this task by offering constructs to handle the initializedness of variables; for example, <a href="C_Sharp_(programming_language)" title="C Sharp (programming language)">C#</a> has a special flavour of call-by-reference parameters to subroutines (specified as <code>out</code> instead of the usual <code>ref</code>), asserting that the variable is allowed to be uninitialized on entry but will be initialized afterwards.

<ul><li><a href="Initialization_(programming)" title="Initialization (programming)">Initialization (programming)</a></li>

<li><a href="Null_pointer" title="Null pointer">Null pointer</a></li>

<li><a href="Undefined_behaviour" class="mw-redirect" title="Undefined behaviour">Undefined behaviour</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

<li id="cite_note-Man7_strcpy-1"><a href="#cite_ref-Man7_strcpy_1-0">^</a> <a rel="nofollow" class="external text" href="http://man7.org/linux/man-pages/man3/strcpy.3.html">strcpy</a>

</li>

<li id="cite_note-Man7_memcpy-2"><a href="#cite_ref-Man7_memcpy_2-0">^</a> <a rel="nofollow" class="external text" href="http://man7.org/linux/man-pages/man3/memcpy.3.html">memcpy()</a>

</li>

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://www.open-std.org/JTC1/SC22/WG14/www/docs/n1256.pdf">"ISO/IEC 9899:TC3 (Current C standard)"</a> (PDF). 2007-09-07. p. 126. Retrieved 2008-09-26.</cite> Section 6.7.8, paragraph 10.

</li>

<li id="cite_note-Java-4"><a href="#cite_ref-Java_4-0">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://docs.oracle.com/javase/specs/jls/se8/html/jls-4.html#jls-4.12.5">"Java Language Specification: 4.12.5 Initial Values of Variables"</a>. <a href="Sun_Microsystems" title="Sun Microsystems">Sun Microsystems</a>. Retrieved 2008-10-18.</cite>

</li>

</ol></div></div>

<div class="mw-heading mw-heading2"><h2 id="Further_reading">Further reading</h2></div>

<ul><li><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://cwe.mitre.org/data/definitions/457.html">"CWE-457 Use of Uninitialized Variable"</a>.</cite></li></ul></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-06-23" href="https://en.wikipedia.org/wiki/?title=Uninitialized_variable&oldid=1296980717">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>