From: Harald Anlauf <anlauf@gmx.de>
To: fortran <fortran@gcc.gnu.org>, gcc-patches <gcc-patches@gcc.gnu.org>
Subject: [PATCH] PR fortran/99147 - Sanitizer detects heap-use-after-free in gfc_add_flavor
Date: Thu, 18 Feb 2021 22:12:21 +0100 [thread overview]
Message-ID: <trinity-ba957585-31b4-421f-8f1f-650fb1f43158-1613682741374@3c-app-gmx-bap37> (raw)
[-- Attachment #1: Type: text/plain, Size: 964 bytes --]
Dear all,
the PR reports an issue detected with an ASAN instrumented compiler,
which can also be verified with valgrind. It appears that the state
of gfc_new_block could be such that it should not be dereferenced.
Reversing the order of condition evaluation helped.
I failed to find out why this should happen, but then other places
in the code put dereferences of gfc_new_block behind other checks.
Simple things like initializing gfc_new_block with NULL in decl.c
did not help.
Regtested on x86_64-pc-linux-gnu. No testcase added since the issue
can be found only with an instrumented compiler or valgrind.
I consider the patch to be obvious and trivial, but post it here
in case somebody wants to dig deeper.
OK for master?
Thanks,
Harald
PR fortran/99147 - Sanitizer detects heap-use-after-free in gfc_add_flavor
Reverse order of conditions to avoid invalid read.
gcc/fortran/ChangeLog:
* symbol.c (gfc_add_flavor): Reverse order of conditions.
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: pr99147.patch --]
[-- Type: text/x-patch, Size: 697 bytes --]
diff --git a/gcc/fortran/symbol.c b/gcc/fortran/symbol.c
index 3b988d1be22..e982374d9d1 100644
--- a/gcc/fortran/symbol.c
+++ b/gcc/fortran/symbol.c
@@ -1772,8 +1772,8 @@ gfc_add_flavor (symbol_attribute *attr, sym_flavor f, const char *name,
/* Copying a procedure dummy argument for a module procedure in a
submodule results in the flavor being copied and would result in
an error without this. */
- if (gfc_new_block && gfc_new_block->abr_modproc_decl
- && attr->flavor == f && f == FL_PROCEDURE)
+ if (attr->flavor == f && f == FL_PROCEDURE
+ && gfc_new_block && gfc_new_block->abr_modproc_decl)
return true;
if (attr->flavor != FL_UNKNOWN)
next reply other threads:[~2021-02-18 21:12 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-18 21:12 Harald Anlauf [this message]
2021-02-19 8:34 ` Paul Richard Thomas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=trinity-ba957585-31b4-421f-8f1f-650fb1f43158-1613682741374@3c-app-gmx-bap37 \
--to=anlauf@gmx.de \
--cc=fortran@gcc.gnu.org \
--cc=gcc-patches@gcc.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).