[patch,libgfortran] Bug 61632 - memory corruption when writing formatted data

[Jerry DeLisle]

Hi all,

This bug was caused by an access to an invalid pointer offset to the format
string. This was only a problem on the second error using the same format
string.  I suspect it has to do with caching the format strings.  Regardless,
the patch fixes this by using the fortran style string lengths to calculate the
position in the string where the error occurs.

Test case attached.

Regression tested on x86-64.

OK for trunk?

2014-07-12  Jerry DeLisle  <jvdeli...@gcc.gnu.org>

        PR libgfortran/61632
        * io/format.c (format_error): Avoid invalid string pointer by
        using the fortran string length values to generate error string.

Index: format.c
===================================================================
--- format.c	(revision 212420)
+++ format.c	(working copy)
@@ -1117,7 +1117,7 @@ parse_format_list (st_parameter_dt *dtp, bool *see
 void
 format_error (st_parameter_dt *dtp, const fnode *f, const char *message)
 {
-  int width, i, j, offset;
+  int width, i, offset;
 #define BUFLEN 300
   char *p, buffer[BUFLEN];
   format_data *fmt = dtp->u.p.fmt;
@@ -1130,13 +1130,10 @@ format_error (st_parameter_dt *dtp, const fnode *f
   else
     snprintf (buffer, BUFLEN, "%s\n", message);
 
-  j = fmt->format_string - dtp->format;
+  offset = dtp->format_len - fmt->format_string_len;
 
-  offset = (j > 60) ? j - 40 : 0;
+  width = dtp->format_len;
 
-  j -= offset;
-  width = dtp->format_len - offset;
-
   if (width > 80)
     width = 80;
 
@@ -1144,14 +1141,14 @@ format_error (st_parameter_dt *dtp, const fnode *f
 
   p = strchr (buffer, '\0');
 
-  memcpy (p, dtp->format + offset, width);
+  memcpy (p, dtp->format, width);
 
   p += width;
   *p++ = '\n';
 
   /* Show where the problem is */
 
-  for (i = 1; i < j; i++)
+  for (i = 1; i < offset; i++)
     *p++ = ' ';
 
   *p++ = '^';

! { dg-do run }
! Bug 61632 - memory corruption writing formatted data in error
      program p
      CHARACTER(3), save :: ZTYP(3)
      DATA ZTYP /'XXX','YYY','ZZZ'/
      write(10,600,IOSTAT=iosta) 0.0,ZTYP
      write(10,600,IOSTAT=iosta) 0.0,ZTYP
      close(10, status='delete')
 600  FORMAT(1PE13.5,4X,A3)
      end program p