https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94048
Dominique d'Humieres <dominiq at lps dot ens.fr> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |NEW
Last reconfirmed| |2020-07-23
Ever confirmed|0 |1
--- Comment #3 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
Confirmed since at least GCC7. My instrumented compiler gives
../../work/gcc/fortran/expr.c:3278:37: runtime error: index 15 out of bounds
for type 'gfc_expr *[15]'
../../work/gcc/fortran/expr.c:3280:35: runtime error: index 15 out of bounds
for type 'gfc_expr *[15]'
../../work/gcc/fortran/expr.c:3282:38: runtime error: index 15 out of bounds
for type 'gfc_expr *[15]'
=================================================================
==16543==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x617000004260 at pc 0x000100140461 bp 0x7ffeefbfe570 sp 0x7ffeefbfe568
READ of size 8 at 0x617000004260 thread T0
#0 0x100140460 in check_references(gfc_ref*, bool (*)(gfc_expr*))
expr.c:3282
#1 0x100160c06 in check_restricted(gfc_expr*) expr.c:3394
#2 0x10016fc77 in restricted_args(gfc_actual_arglist*) expr.c:3157
#3 0x10016fd1c in restricted_intrinsic(gfc_expr*) expr.c:3245
#4 0x100160923 in check_restricted(gfc_expr*) expr.c:3356
#5 0x100160067 in gfc_specification_expr(gfc_expr*) expr.c:3497
#6 0x100017254 in resolve_array_bound(gfc_expr*, int) array.c:379
#7 0x10001e426 in gfc_resolve_array_spec(gfc_array_spec*, int) array.c:422
#8 0x10040013c in resolve_symbol(gfc_symbol*) resolve.c:15922
#9 0x1003f8ccd in resolve_symbol(gfc_symbol*) resolve.c:15334
#10 0x1004f2aa6 in do_traverse_symtree(gfc_symtree*, void
(*)(gfc_symtree*), void (*)(gfc_symbol*)) symbol.c:4170
#11 0x100511004 in gfc_traverse_ns(gfc_namespace*, void (*)(gfc_symbol*))
symbol.c:4195
#12 0x100454636 in resolve_types(gfc_namespace*) resolve.c:17211
#13 0x1003f3e32 in gfc_resolve(gfc_namespace*) resolve.c:17326
#14 0x100375344 in gfc_parse_file() parse.c:6448
#15 0x10055baf3 in gfc_be_parse_file() f95-lang.c:212
#16 0x106bdcb9c in compile_file() toplev.c:458
#17 0x106bebc34 in do_compile() toplev.c:2307
#18 0x10a663058 in toplev::main(int, char**) toplev.c:2446
#19 0x10ac0eea4 in main main.c:39
#20 0x7fff6e3decc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)
0x617000004260 is located 0 bytes to the right of 736-byte region
[0x617000003f80,0x617000004260)
allocated by thread T0 here:
#0 0x15bc6200f in wrap_calloc sanitizer_flags.h:38
#1 0x1098e04ca in xcalloc xmalloc.c:162
#2 0x100436be1 in resolve_actual_arglist(gfc_actual_arglist*,
procedure_type, bool) resolve.c:2069
#3 0x100413232 in resolve_function(gfc_expr*) resolve.c:3208
#4 0x100416423 in gfc_resolve_expr(gfc_expr*) resolve.c:7056
#5 0x100017234 in resolve_array_bound(gfc_expr*, int) array.c:378
#6 0x10001e426 in gfc_resolve_array_spec(gfc_array_spec*, int) array.c:422
#7 0x10040013c in resolve_symbol(gfc_symbol*) resolve.c:15922
#8 0x1003f8ccd in resolve_symbol(gfc_symbol*) resolve.c:15334
#9 0x1004f2aa6 in do_traverse_symtree(gfc_symtree*, void (*)(gfc_symtree*),
void (*)(gfc_symbol*)) symbol.c:4170
#10 0x100511004 in gfc_traverse_ns(gfc_namespace*, void (*)(gfc_symbol*))
symbol.c:4195
#11 0x100454636 in resolve_types(gfc_namespace*) resolve.c:17211
#12 0x1003f3e32 in gfc_resolve(gfc_namespace*) resolve.c:17326
#13 0x100375344 in gfc_parse_file() parse.c:6448
#14 0x10055baf3 in gfc_be_parse_file() f95-lang.c:212
#15 0x106bdcb9c in compile_file() toplev.c:458
#16 0x106bebc34 in do_compile() toplev.c:2307
#17 0x10a663058 in toplev::main(int, char**) toplev.c:2446
#18 0x10ac0eea4 in main main.c:39
#19 0x7fff6e3decc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)
SUMMARY: AddressSanitizer: heap-buffer-overflow expr.c:3282 in
check_references(gfc_ref*, bool (*)(gfc_expr*))
Shadow bytes around the buggy address:
0x1c2e000007f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1c2e00000800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1c2e00000810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1c2e00000820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1c2e00000830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x1c2e00000840: 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa
0x1c2e00000850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c2e00000860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c2e00000870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c2e00000880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c2e00000890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==16543==ABORTING
f951: internal compiler error: Abort trap: 6
