diff mbox series

PR fortran/95828 - Buffer overflows with SELECT RANK

Message ID trinity-4c1a7ea3-3a92-475c-9232-fc7446ce1c02-1593034265489@3c-app-gmx-bs13
State New
Headers show
Series PR fortran/95828 - Buffer overflows with SELECT RANK | expand

Commit Message

Harald Anlauf June 24, 2020, 9:31 p.m. UTC 
Another case of buffer overflow, this time coming in pairs.

Regtested on x86_64-pc-linux-gnu.

OK for master?

Thanks,
Harald


PR fortran/95828 - Buffer overflows with SELECT RANK

With SELECT RANK, name mangling results in long internal symbols that
overflows internal buffers.  Fix that.

gcc/fortran/
	PR fortran/95828
	* match.c (select_rank_set_tmp): Enlarge internal buffer used in
	generating a mangled name.
	* resolve.c (resolve_select_rank): Likewise.

Comments

Thomas Koenig June 25, 2020, 6:20 a.m. UTC | #1 
Hi Harald,

> Another case of buffer overflow, this time coming in pairs.
> 
> Regtested on x86_64-pc-linux-gnu.
> 
> OK for master?

OK.

Thanks for tackling this!  I haven't checked, but you are
probably setting a new record for bug fixes per second now :-)

Best regards

	Thomas
Harald Anlauf June 25, 2020, 6:42 p.m. UTC | #2 
Hi Thomas,

> Thanks for tackling this!  I haven't checked, but you are
> probably setting a new record for bug fixes per second now :-)

I'm trying hard, but I definitely cannot outpace Gerhard.  Any attempt
in this regard seems futile.  |-:

The good thing is that while hunting down things there's some fallout,
sometimes positive, and sometimes negative.. :-o

Harald
diff mbox series

Patch

diff --git a/gcc/fortran/match.c b/gcc/fortran/match.c
index 8063fcad295..b011634792e 100644
--- a/gcc/fortran/match.c
+++ b/gcc/fortran/match.c
@@ -6496,7 +6496,7 @@  static void
 select_rank_set_tmp (gfc_typespec *ts, int *case_value)
 {
   char name[2 * GFC_MAX_SYMBOL_LEN];
-  char tname[GFC_MAX_SYMBOL_LEN];
+  char tname[GFC_MAX_SYMBOL_LEN + 7];
   gfc_symtree *tmp;
   gfc_symbol *selector = select_type_stack->selector;
   gfc_symbol *sym;
diff --git a/gcc/fortran/resolve.c b/gcc/fortran/resolve.c
index c53b312f7ed..cc8676b3e03 100644
--- a/gcc/fortran/resolve.c
+++ b/gcc/fortran/resolve.c
@@ -9638,7 +9638,7 @@  resolve_select_rank (gfc_code *code, gfc_namespace *old_ns)
   gfc_namespace *ns;
   gfc_code *body, *new_st, *tail;
   gfc_case *c;
-  char tname[GFC_MAX_SYMBOL_LEN];
+  char tname[GFC_MAX_SYMBOL_LEN + 7];
   char name[2 * GFC_MAX_SYMBOL_LEN];
   gfc_symtree *st;
   gfc_expr *selector_expr = NULL;
diff --git a/gcc/testsuite/gfortran.dg/pr95828.f90 b/gcc/testsuite/gfortran.dg/pr95828.f90
new file mode 100644
index 00000000000..e85b2f11869
--- /dev/null
+++ b/gcc/testsuite/gfortran.dg/pr95828.f90
@@ -0,0 +1,21 @@ 
+! { dg-do compile }
+! { dg-options "-fsecond-underscore" }
+! PR fortran/95828 - ICE in resolve_select_rank, at fortran/resolve.c:9774
+
+module m2345678901234567890123456789012345678901234567890123456789_123
+  type t2345678901234567890123456789012345678901234567890123456789_123
+  end type
+contains
+  subroutine s2345678901234567890123456789012345678901234567890123456789_123 &
+            (x2345678901234567890123456789012345678901234567890123456789_123)
+    type    (t2345678901234567890123456789012345678901234567890123456789_123) :: &
+             x2345678901234567890123456789012345678901234567890123456789_123(..)
+
+    select rank (y2345678901234567890123456789012345678901234567890123456789_123 &
+              => x2345678901234567890123456789012345678901234567890123456789_123)
+    rank (2)
+    rank (3)
+    rank default
+    end select
+  end
+end