From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from troutmask.apl.washington.edu (troutmask.apl.washington.edu [128.95.76.21]) by sourceware.org (Postfix) with ESMTPS id 221DB3857C48; Fri, 26 Mar 2021 17:29:14 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 221DB3857C48 Received: from troutmask.apl.washington.edu (localhost [127.0.0.1]) by troutmask.apl.washington.edu (8.16.1/8.16.1) with ESMTPS id 12QHTCTs069638 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO); Fri, 26 Mar 2021 10:29:12 -0700 (PDT) (envelope-from sgk@troutmask.apl.washington.edu) Received: (from sgk@localhost) by troutmask.apl.washington.edu (8.16.1/8.16.1/Submit) id 12QHTCoX069637; Fri, 26 Mar 2021 10:29:12 -0700 (PDT) (envelope-from sgk) Date: Fri, 26 Mar 2021 10:29:11 -0700 From: Steve Kargl To: fortran@gcc.gnu.org, gcc-patches@gcc.gnu.org Subject: off-by-one buffer overflow patch Message-ID: <20210326172911.GA69632@troutmask.apl.washington.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-7.9 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_STATUS, KAM_LAZY_DOMAIN_SECURITY, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: fortran@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Fortran mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Mar 2021 17:29:15 -0000 This patch fixes an off-by-one buffer overflow issue. Please commit. diff --git a/gcc/fortran/misc.c b/gcc/fortran/misc.c index 8a96243e80d..3d449ae17fe 100644 --- a/gcc/fortran/misc.c +++ b/gcc/fortran/misc.c @@ -124,8 +124,10 @@ gfc_basic_typename (bt type) const char * gfc_typename (gfc_typespec *ts, bool for_hash) { - static char buffer1[GFC_MAX_SYMBOL_LEN + 7]; /* 7 for "TYPE()" + '\0'. */ - static char buffer2[GFC_MAX_SYMBOL_LEN + 7]; + /* Need to add sufficient padding for "TYPE()" + '\0', "UNION()" + '\0', + or "CLASS()" + '\0'. */ + static char buffer1[GFC_MAX_SYMBOL_LEN + 8]; + static char buffer2[GFC_MAX_SYMBOL_LEN + 8]; static int flag = 0; char *buffer; gfc_typespec *ts1; -- Steve