Conditional jump or move depends on uninitialised value(s) in C - c

Question

I have this function that return a parsed_url structure that looks like this
typedef struct url_parser_url {
char *protocol;
char *host;
int port;
char *path;
char *query_string;
int host_exists;
} url_parser_url_t;
url_parser_url_t *parsed_url;
parsed_url = (url_parser_url_t *) malloc(sizeof(url_parser_url_t));
parse_url(address, true, parsed_url);
printf("parsed_url->path = %s\n", parsed_url->path);
The parse_url function looks like
int parse_url(char *url, bool verify_host, url_parser_url_t *parsed_url) {
char *local_url = (char *) malloc(sizeof(char) * (strlen(url) + 1));
char *token;
char *token_host;
char *host_port;
char *token_ptr;
char *host_token_ptr;
char *path = NULL;
strcpy(local_url, url);
token = strtok_r(local_url, ":", &token_ptr);
parsed_url->protocol = (char *) malloc(sizeof(char) * strlen(token) + 1);
strcpy(parsed_url->protocol, token);
token = strtok_r(NULL, "/", &token_ptr);
if (token) {
host_port = (char *) malloc(sizeof(char) * (strlen(token) + 1));
strcpy(host_port, token);
} else {
host_port = (char *) malloc(sizeof(char) * 1);
strcpy(host_port, "");
}
token_host = strtok_r(host_port, ":", &host_token_ptr);
if (token_host) {
parsed_url->host = (char *) malloc(
sizeof(char) * strlen(token_host) + 1);
strcpy(parsed_url->host, token_host);
if (verify_host) {
struct hostent *host;
host = gethostbyname(parsed_url->host);
if (host != NULL) {
parsed_url->host_exists = 1;
} else {
parsed_url->host_exists = 0;
}
} else {
parsed_url->host_exists = -1;
}
} else {
parsed_url->host_exists = -1;
parsed_url->host = NULL;
}
token_host = strtok_r(NULL, ":", &host_token_ptr);
if (token_host)
parsed_url->port = atoi(token_host);
else
parsed_url->port = 0;
token_host = strtok_r(NULL, ":", &host_token_ptr);
assert(token_host == NULL);
token = strtok_r(NULL, "?", &token_ptr);
parsed_url->path = NULL;
if (token) {
path = (char *) realloc(path, sizeof(char) * (strlen(token) + 2));
strcpy(path, "/");
strcat(path, token);
parsed_url->path = (char *) malloc(sizeof(char) * strlen(path) + 1);
strncpy(parsed_url->path, path, strlen(path));
free(path);
} else {
parsed_url->path = (char *) malloc(sizeof(char) * 2);
strcpy(parsed_url->path, "/");
}
token = strtok_r(NULL, "?", &token_ptr);
if (token) {
parsed_url->query_string = (char *) malloc(
sizeof(char) * (strlen(token) + 1));
strncpy(parsed_url->query_string, token, strlen(token));
} else {
parsed_url->query_string = NULL;
}
token = strtok_r(NULL, "?", &token_ptr);
assert(token == NULL);
free(local_url);
free(host_port);
return 0;
}
The problem is when I call the function parse_url and then I use the parsed_url->path member it throws me this segmentation fault
==16647== Conditional jump or move depends on uninitialised value(s)
Can anyone to explain me what is happening and why ? Thank you

Answer 1

And there it is. Although it is supposed to be a safer alternative to strcpy(), the strncpy() has a nasty wart. The standard says:
The strncpy function copies not more than n characters (characters that follow a null character are not copied) from the array pointed to by s2 to the array pointed to by s1.
(C2011 7.24.2.4/2), and note 308 clarifies that
Thus, if there is no null character in the first n characters of the array pointed to by s2, the result will not be null-terminated.
The code that is ultimately responsible for your particular valgrind complaint is this:
strncpy(parsed_url->path, path, strlen(path));
Since by definition there cannot be a null character within the first strlen(path) characters of path, that strncpy() reliably fails to ensure that the copy is null-terminated. You have at least one other instance of the same problem in your code.
Since you seem to take sufficient care to ensure that enough space is available, one solution would be to switch from strncpy() to strcpy(). That would also be more efficient, because you would avoid duplicate calls to strlen().
As I noted in comments, however, if you're willing to rely on POSIX's strdup(), then that's cleaner than strlen() + malloc() + str[n]cpy(), and has the same semantics (you take responsibility for freeing the memory allocated for the copy). You wouldn't have even had the opportunity to make these errors if you had made your copies that way.