Skip to content

MSAN: unintialized memory in bb::GoblinTranslatorProver::compute_commitment_key #930

Description

@ludamad
==559==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x57845260d8df in unsigned int bb::scalar_multiplication::construct_addition_chains<bb::curve::BN254>(bb::scalar_multiplication::affine_product_runtime_state<bb::curve::BN254>&, bool) /usr/src/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp:609:21
    #1 0x57845278130c in bb::curve::BN254::AffineElement* bb::scalar_multiplication::reduce_buckets<bb::curve::BN254>(bb::scalar_multiplication::affine_product_runtime_state<bb::curve::BN254>&, bool, bool) /usr/src/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp:476:36
    #2 0x57845294beb6 in bb::curve::BN254::Element bb::scalar_multiplication::evaluate_pippenger_rounds<bb::curve::BN254>(bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&, bb::curve::BN254::AffineElement*, unsigned long, bool)::'lambda'(unsigned long)::operator()(unsigned long) const /usr/src/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp:786:49
    #3 0x578452949a4c in decltype(std::declval<bb::curve::BN254>()(std::declval<unsigned long>())) std::__1::__invoke[abi:v160006]<bb::curve::BN254::Element bb::scalar_multiplication::evaluate_pippenger_rounds<bb::curve::BN254>(bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&, bb::curve::BN254::AffineElement*, unsigned long, bool)::'lambda'(unsigned long)&, unsigned long>(bb::curve::BN254&&, unsigned long&&) /opt/include/c++/v1/__functional/invoke.h:394:23
    #4 0x5784529497d2 in void std::__1::__invoke_void_return_wrapper<void, true>::__call<bb::curve::BN254::Element bb::scalar_multiplication::evaluate_pippenger_rounds<bb::curve::BN254>(bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&, bb::curve::BN254::AffineElement*, unsigned long, bool)::'lambda'(unsigned long)&, unsigned long>(bb::curve::BN254::Element bb::scalar_multiplication::evaluate_pippenger_rounds<bb::curve::BN254>(bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&, bb::curve::BN254::AffineElement*, unsigned long, bool)::'lambda'(unsigned long)&, unsigned long&&) /opt/include/c++/v1/__functional/invoke.h:487:9
    #5 0x57845294965f in std::__1::__function::__alloc_func<bb::curve::BN254::Element bb::scalar_multiplication::evaluate_pippenger_rounds<bb::curve::BN254>(bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&, bb::curve::BN254::AffineElement*, unsigned long, bool)::'lambda'(unsigned long), std::__1::allocator<bb::curve::BN254::Element bb::scalar_multiplication::evaluate_pippenger_rounds<bb::curve::BN254>(bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&, bb::curve::BN254::AffineElement*, unsigned long, bool)::'lambda'(unsigned long)>, void (unsigned long)>::operator()[abi:v160006](unsigned long&&) /opt/include/c++/v1/__functional/function.h:185:16
    #6 0x578452942cfe in std::__1::__function::__func<bb::curve::BN254::Element bb::scalar_multiplication::evaluate_pippenger_rounds<bb::curve::BN254>(bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&, bb::curve::BN254::AffineElement*, unsigned long, bool)::'lambda'(unsigned long), std::__1::allocator<bb::curve::BN254::Element bb::scalar_multiplication::evaluate_pippenger_rounds<bb::curve::BN254>(bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&, bb::curve::BN254::AffineElement*, unsigned long, bool)::'lambda'(unsigned long)>, void (unsigned long)>::operator()(unsigned long&&) /opt/include/c++/v1/__functional/function.h:356:12
    #7 0x578452a03fae in std::__1::__function::__value_func<void (unsigned long)>::operator()[abi:v160006](unsigned long&&) const /opt/include/c++/v1/__functional/function.h:510:16
    #8 0x578452a03c9f in std::__1::function<void (unsigned long)>::operator()(unsigned long) const /opt/include/c++/v1/__functional/function.h:1156:12
    #9 0x5784529f58b6 in bb::parallel_for(unsigned long, std::__1::function<void (unsigned long)> const&) /usr/src/barretenberg/cpp/src/barretenberg/common/thread.cpp:76:9
    #10 0x578452780589 in bb::curve::BN254::Element bb::scalar_multiplication::evaluate_pippenger_rounds<bb::curve::BN254>(bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&, bb::curve::BN254::AffineElement*, unsigned long, bool) /usr/src/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp:756:5
    #11 0x57845277dff2 in bb::curve::BN254::Element bb::scalar_multiplication::pippenger_internal<bb::curve::BN254>(bb::curve::BN254::AffineElement*, bb::curve::BN254::ScalarField*, unsigned long, bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&, bool) /usr/src/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp:869:9
    #12 0x578452784c97 in bb::curve::BN254::Element bb::scalar_multiplication::pippenger<bb::curve::BN254>(bb::curve::BN254::ScalarField*, bb::curve::BN254::AffineElement*, unsigned long, bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&, bool) /usr/src/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp:912:22
    #13 0x578452785775 in bb::curve::BN254::Element bb::scalar_multiplication::pippenger_unsafe<bb::curve::BN254>(bb::curve::BN254::ScalarField*, bb::curve::BN254::AffineElement*, unsigned long, bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>&) /usr/src/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp:946:12
    #14 0x57843e2a7378 in bb::CommitmentKey<bb::curve::BN254>::commit(std::__1::span<bb::field<bb::Bn254FrParams> const, 18446744073709551615ul>) /usr/src/barretenberg/cpp/src/barretenberg/ecc/curves/bn254/../../fields/./field_impl_generic.hpp:48:21
    #15 0x578446a2d888 in bb::GoblinTranslatorProver::execute_grand_product_computation_round() /usr/src/barretenberg/cpp/src/barretenberg/translator_vm/goblin_translator_prover.cpp:295:76
    #16 0x578446a2f565 in bb::GoblinTranslatorProver::construct_proof() /usr/src/barretenberg/cpp/src/barretenberg/translator_vm/goblin_translator_prover.cpp:353:5
    #17 0x57843f4550b3 in bb::Goblin::prove_translator() /usr/src/barretenberg/cpp/src/barretenberg/goblin/goblin.hpp:178:60
    #18 0x57843f44a9bf in bb::Goblin::prove() /usr/src/barretenberg/cpp/src/barretenberg/goblin/goblin.hpp:192:9
    #19 0x57843f444329 in bb::ClientIVC::prove() /usr/src/barretenberg/cpp/src/barretenberg/client_ivc/client_ivc.cpp:40:71
    #20 0x57843e1b5bf8 in ClientIVCTests_Full_Test::TestBody() (/usr/src/barretenberg/cpp/build-msan/bin/client_ivc_tests+0xccbf8) (BuildId: 9fe8d221bd513f0c2729ccb11f67e09a8b6de15b)
    #21 0x57843f727174 in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest.cc:2621:10
    #22 0x57843f585091 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest.cc:2657:14
    #23 0x57843f4ec6d8 in testing::Test::Run() /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest.cc:2696:5
    #24 0x57843f4efd4b in testing::TestInfo::Run() /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest.cc:2845:11
    #25 0x57843f4f2cab in testing::TestSuite::Run() /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest.cc:3004:30
    #26 0x57843f532f56 in testing::internal::UnitTestImpl::RunAllTests() /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest.cc:5890:44
    #27 0x57843f72a8b4 in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest.cc:2621:10
    #28 0x57843f5950bd in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest.cc:2657:14
    #29 0x57843f530c8f in testing::UnitTest::Run() /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest.cc:5455:10
    #30 0x57843f732540 in RUN_ALL_TESTS() /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/include/gtest/gtest.h:2314:73
    #31 0x57843f732529 in main /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest_main.cc:63:10
    #32 0x7ca11f95ca8f  (/lib/x86_64-linux-gnu/libc.so.6+0x23a8f) (BuildId: d320ce4e63925d698610ed423fc4b1f0e8ed51f1)
    #33 0x7ca11f95cb48 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x23b48) (BuildId: d320ce4e63925d698610ed423fc4b1f0e8ed51f1)
    #34 0x57843e12a6a4 in _start (/usr/src/barretenberg/cpp/build-msan/bin/client_ivc_tests+0x416a4) (BuildId: 9fe8d221bd513f0c2729ccb11f67e09a8b6de15b)

  Uninitialized value was created by a heap allocation
    #0 0x57843e15753e in aligned_alloc (/usr/src/barretenberg/cpp/build-msan/bin/client_ivc_tests+0x6e53e) (BuildId: 9fe8d221bd513f0c2729ccb11f67e09a8b6de15b)
    #1 0x57845167a1ce in protected_aligned_alloc(unsigned long, unsigned long) /usr/src/barretenberg/cpp/src/barretenberg/common/mem.hpp:39:9
    #2 0x5784529b253e in (anonymous namespace)::SlabAllocator::get(unsigned long) /usr/src/barretenberg/cpp/src/barretenberg/common/slab_allocator.cpp:181:18
    #3 0x5784529b13cf in bb::get_mem_slab(unsigned long) /usr/src/barretenberg/cpp/src/barretenberg/common/slab_allocator.cpp:219:22
    #4 0x5784525c490a in bb::scalar_multiplication::pippenger_runtime_state<bb::curve::BN254>::pippenger_runtime_state(unsigned long) /usr/src/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/runtime_states.cpp:27:11
    #5 0x57843e2a5b1d in bb::CommitmentKey<bb::curve::BN254>::CommitmentKey(unsigned long) /usr/src/barretenberg/cpp/src/barretenberg/ecc/curves/bn254/../../fields/./field_impl_generic.hpp:423:11
    #6 0x57844365a254 in bb::CommitmentKey<bb::curve::BN254>* std::__1::construct_at[abi:v160006]<bb::CommitmentKey<bb::curve::BN254>, unsigned long&, bb::CommitmentKey<bb::curve::BN254>*>(bb::CommitmentKey<bb::curve::BN254>*, unsigned long&) /opt/include/c++/v1/__memory/construct_at.h:38:48
    #7 0x578443659f62 in void std::__1::allocator_traits<std::__1::allocator<bb::CommitmentKey<bb::curve::BN254>>>::construct[abi:v160006]<bb::CommitmentKey<bb::curve::BN254>, unsigned long&, void, void>(std::__1::allocator<bb::CommitmentKey<bb::curve::BN254>>&, bb::CommitmentKey<bb::curve::BN254>*, unsigned long&) /opt/include/c++/v1/__memory/allocator_traits.h:304:9
    #8 0x578443659d01 in std::__1::__shared_ptr_emplace<bb::CommitmentKey<bb::curve::BN254>, std::__1::allocator<bb::CommitmentKey<bb::curve::BN254>>>::__shared_ptr_emplace[abi:v160006]<unsigned long&>(std::__1::allocator<bb::CommitmentKey<bb::curve::BN254>>, unsigned long&) /opt/include/c++/v1/__memory/shared_ptr.h:284:13
    #9 0x57844365983a in std::__1::shared_ptr<bb::CommitmentKey<bb::curve::BN254>> std::__1::allocate_shared[abi:v160006]<bb::CommitmentKey<bb::curve::BN254>, std::__1::allocator<bb::CommitmentKey<bb::curve::BN254>>, unsigned long&, void>(std::__1::allocator<bb::CommitmentKey<bb::curve::BN254>> const&, unsigned long&) /opt/include/c++/v1/__memory/shared_ptr.h:995:55
    #10 0x5784435eb756 in std::__1::shared_ptr<bb::CommitmentKey<bb::curve::BN254>> std::__1::make_shared[abi:v160006]<bb::CommitmentKey<bb::curve::BN254>, unsigned long&, void>(unsigned long&) /opt/include/c++/v1/__memory/shared_ptr.h:1004:12
    #11 0x5784469f3f0e in bb::GoblinTranslatorProver::compute_commitment_key(unsigned long) /usr/src/barretenberg/cpp/src/barretenberg/translator_vm/goblin_translator_prover.cpp:211:22
    #12 0x5784469f0fbc in bb::GoblinTranslatorProver::GoblinTranslatorProver(bb::GoblinTranslatorCircuitBuilder&, std::__1::shared_ptr<bb::BaseTranscript<bb::NativeTranscriptParams>> const&) /usr/src/barretenberg/cpp/src/barretenberg/translator_vm/goblin_translator_prover.cpp:54:5
    #13 0x57843f46ed6b in std::__1::__unique_if<bb::GoblinTranslatorProver>::__unique_single std::__1::make_unique[abi:v160006]<bb::GoblinTranslatorProver, bb::GoblinTranslatorCircuitBuilder&, std::__1::shared_ptr<bb::ECCVMBase<bb::group<bb::field<bb::Bn254FqParams>, bb::field<bb::Bn254FrParams>, bb::Bn254G1Params>, bb::curve::Grumpkin, bb::IPA<bb::curve::Grumpkin>>::Transcript>&>(bb::GoblinTranslatorCircuitBuilder&, std::__1::shared_ptr<bb::ECCVMBase<bb::group<bb::field<bb::Bn254FqParams>, bb::field<bb::Bn254FrParams>, bb::Bn254G1Params>, bb::curve::Grumpkin, bb::IPA<bb::curve::Grumpkin>>::Transcript>&) /opt/include/c++/v1/__memory/unique_ptr.h:686:30
    #14 0x57843f455026 in bb::Goblin::prove_translator() /usr/src/barretenberg/cpp/src/barretenberg/goblin/goblin.hpp:177:29
    #15 0x57843f44a9bf in bb::Goblin::prove() /usr/src/barretenberg/cpp/src/barretenberg/goblin/goblin.hpp:192:9
    #16 0x57843f444329 in bb::ClientIVC::prove() /usr/src/barretenberg/cpp/src/barretenberg/client_ivc/client_ivc.cpp:40:71
    #17 0x57843e1b5bf8 in ClientIVCTests_Full_Test::TestBody() (/usr/src/barretenberg/cpp/build-msan/bin/client_ivc_tests+0xccbf8) (BuildId: 9fe8d221bd513f0c2729ccb11f67e09a8b6de15b)
    #18 0x57843f727174 in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest.cc:2621:10
    #19 0x57843f585091 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /usr/src/barretenberg/cpp/build-msan/_deps/gtest-src/googletest/src/gtest.cc:2657:14

SUMMARY: MemorySanitizer: use-of-uninitialized-value /usr/src/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp:609:21 in unsigned int bb::scalar_multiplication::construct_addition_chains<bb::curve::BN254>(bb::scalar_multiplication::affine_product_runtime_state<bb::curve::BN254>&, bool)
Exiting
root@4526e06691b2:/usr/src/barretenberg/cpp/build-msan# cd build-msan/n                                                                      bash: cd: build-msan/n: No such file or directory
root@4526e06691b2:/usr/src/barretenberg/cpp/build-msan# cd build-msan/n

Activity

  1. ludamad commented on Oct 26, 2025

    @ludamad
    CollaboratorAuthor

    From old scalar mul

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    auditThings to do during the next audit

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions