https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99255
Vittorio Zecca <zeccav at gmail dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |zeccav at gmail dot com
--- Comment #1 from Vittorio Zecca <zeccav at gmail dot com> ---
A sanitized version of the compiler fails earlier at class.c line 487
"if (derived->attr.unlimited_polymorphic)"
~/local/gcc-150221-sanitized/bin/gfortran -S z1.f90
=================================================================
==8457==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400000172d
at pc 0x000000496c01 bp 0x7fffca9abcd0 sp 0x7fffca9abcc8
READ of size 1 at 0x60400000172d thread T0
#0 0x496c00 in get_unique_type_string
../../gcc-150221/gcc/fortran/class.c:487
#1 0x4972c9 in get_unique_hashed_string
../../gcc-150221/gcc/fortran/class.c:524
#2 0x498610 in gfc_build_class_symbol(gfc_typespec*, symbol_attribute*,
gfc_array_spec**) ../../gcc-150221/gcc/fortran/class.c:672
#3 0x709d96 in copy_ts_from_selector_to_associate
../../gcc-150221/gcc/fortran/match.c:6237
#4 0x70dc8a in gfc_match_select_type()
../../gcc-150221/gcc/fortran/match.c:6431
#5 0x7f2b01 in match_word ../../gcc-150221/gcc/fortran/parse.c:65
#6 0x7f4b32 in decode_statement ../../gcc-150221/gcc/fortran/parse.c:428
#7 0x7fd6c8 in next_free ../../gcc-150221/gcc/fortran/parse.c:1316
#8 0x7fe845 in next_statement ../../gcc-150221/gcc/fortran/parse.c:1548
#9 0x80cb86 in parse_spec ../../gcc-150221/gcc/fortran/parse.c:3967
#10 0x81bef7 in parse_progunit ../../gcc-150221/gcc/fortran/parse.c:5896
#11 0x821732 in gfc_parse_file() ../../gcc-150221/gcc/fortran/parse.c:6437
#12 0xa64b7c in gfc_be_parse_file
../../gcc-150221/gcc/fortran/f95-lang.c:212
#13 0x33fa43d in compile_file ../../gcc-150221/gcc/toplev.c:457
#14 0x34097a2 in do_compile ../../gcc-150221/gcc/toplev.c:2197
#15 0x340a39f in toplev::main(int, char**)
../../gcc-150221/gcc/toplev.c:2336
#16 0x7f24cb9 in main ../../gcc-150221/gcc/main.c:39
#17 0x15054552b1e1 in __libc_start_main (/usr/lib64/libc.so.6+0x281e1)
#18 0x41958d in _start
(/home/vitti/1TB/local/gcc-150221-sanitized/libexec/gcc/x86_64-pc-linux-gnu/11.0.0/f951+0x41958d)
0x60400000172d is located 29 bytes inside of 48-byte region
[0x604000001710,0x604000001740)
freed by thread T0 here:
#0 0x15054647d797 in __interceptor_free
../../../../gcc-150221/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0xa1cd6f in gfc_delete_symtree(gfc_symtree**, char const*)
../../gcc-150221/gcc/fortran/symbol.c:2964
#2 0xa25801 in gfc_restore_last_undo_checkpoint()
../../gcc-150221/gcc/fortran/symbol.c:3706
#3 0xa25a5f in gfc_undo_symbols()
../../gcc-150221/gcc/fortran/symbol.c:3739
#4 0x80175f in reject_statement ../../gcc-150221/gcc/fortran/parse.c:2678
#5 0x7f2bb0 in match_word ../../gcc-150221/gcc/fortran/parse.c:70
#6 0x7f42d9 in decode_statement ../../gcc-150221/gcc/fortran/parse.c:361
#7 0x7fd6c8 in next_free ../../gcc-150221/gcc/fortran/parse.c:1316
#8 0x7fe845 in next_statement ../../gcc-150221/gcc/fortran/parse.c:1548
#9 0x8088f0 in parse_derived ../../gcc-150221/gcc/fortran/parse.c:3387
#10 0x80c81b in parse_spec ../../gcc-150221/gcc/fortran/parse.c:3928
#11 0x81bef7 in parse_progunit ../../gcc-150221/gcc/fortran/parse.c:5896
#12 0x821732 in gfc_parse_file() ../../gcc-150221/gcc/fortran/parse.c:6437
#13 0xa64b7c in gfc_be_parse_file
../../gcc-150221/gcc/fortran/f95-lang.c:212
#14 0x33fa43d in compile_file ../../gcc-150221/gcc/toplev.c:457
#15 0x34097a2 in do_compile ../../gcc-150221/gcc/toplev.c:2197
#16 0x340a39f in toplev::main(int, char**)
../../gcc-150221/gcc/toplev.c:2336
#17 0x7f24cb9 in main ../../gcc-150221/gcc/main.c:39
#18 0x15054552b1e1 in __libc_start_main (/usr/lib64/libc.so.6+0x281e1)
previously allocated by thread T0 here:
#0 0x15054647dc47 in __interceptor_calloc
../../../../gcc-150221/libsanitizer/asan/asan_malloc_linux.cpp:154
#1 0x83c3e31 in xcalloc ../../gcc-150221/libiberty/xmalloc.c:162
#2 0xa1cade in gfc_new_symtree(gfc_symtree**, char const*)
../../gcc-150221/gcc/fortran/symbol.c:2934
#3 0xa20eed in gfc_get_sym_tree(char const*, gfc_namespace*, gfc_symtree**,
bool) ../../gcc-150221/gcc/fortran/symbol.c:3384
#4 0xa21e11 in gfc_get_ha_sym_tree(char const*, gfc_symtree**)
../../gcc-150221/gcc/fortran/symbol.c:3469
#5 0x6df4b3 in gfc_match_sym_tree(gfc_symtree**, int)
../../gcc-150221/gcc/fortran/match.c:706
#6 0x84d6f7 in match_variable ../../gcc-150221/gcc/fortran/primary.c:4024
#7 0x84f424 in gfc_match_variable(gfc_expr**, int)
../../gcc-150221/gcc/fortran/primary.c:4168
#8 0x6e1a00 in gfc_match(char const*, ...)
../../gcc-150221/gcc/fortran/match.c:1162
#9 0x6e2894 in gfc_match_assignment()
../../gcc-150221/gcc/fortran/match.c:1340
#10 0x7f2b01 in match_word ../../gcc-150221/gcc/fortran/parse.c:65
#11 0x7f42d9 in decode_statement ../../gcc-150221/gcc/fortran/parse.c:361
#12 0x7fd6c8 in next_free ../../gcc-150221/gcc/fortran/parse.c:1316
#13 0x7fe845 in next_statement ../../gcc-150221/gcc/fortran/parse.c:1548
#14 0x8088f0 in parse_derived ../../gcc-150221/gcc/fortran/parse.c:3387
#15 0x80c81b in parse_spec ../../gcc-150221/gcc/fortran/parse.c:3928
#16 0x81bef7 in parse_progunit ../../gcc-150221/gcc/fortran/parse.c:5896
#17 0x821732 in gfc_parse_file() ../../gcc-150221/gcc/fortran/parse.c:6437
#18 0xa64b7c in gfc_be_parse_file
../../gcc-150221/gcc/fortran/f95-lang.c:212
#19 0x33fa43d in compile_file ../../gcc-150221/gcc/toplev.c:457
#20 0x34097a2 in do_compile ../../gcc-150221/gcc/toplev.c:2197
#21 0x340a39f in toplev::main(int, char**)
../../gcc-150221/gcc/toplev.c:2336
#22 0x7f24cb9 in main ../../gcc-150221/gcc/main.c:39
#23 0x15054552b1e1 in __libc_start_main (/usr/lib64/libc.so.6+0x281e1)
SUMMARY: AddressSanitizer: heap-use-after-free
../../gcc-150221/gcc/fortran/class.c:487 in get_unique_type_string
