[Bug libfortran/18958] New: eoshift segfaults when shifting off the end of an array

[Bug libfortran/18958] New: eoshift segfaults when shifting off the end of an array

[Thomas dot Koenig at online dot de]

$ cat eoshift.f90
  print *,eoshift((/1, 3/), 3)
end
$ gfortran eoshift.f90
$ ./a.out
Segmentation fault
$ gfortran -v
Reading specs from /home/zfkts/lib/gcc/ia64-unknown-linux-gnu/4.0.0/specs
Configured with: ../gcc-4.0-20041205/configure --prefix=/home/zfkts
--enable-languages=c,c++,f95 --disable-shared
Thread model: posix
gcc version 4.0.0 20041205 (experimental)

-- 
           Summary: eoshift segfaults when shifting off the end of an array
           Product: gcc
           Version: 4.0.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libfortran
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: Thomas dot Koenig at online dot de
                CC: gcc-bugs at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18958

[Bug libfortran/18958] eoshift segfaults when shifting off the end of an array

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-12-13 16:07 -------
Confirmed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
   Last reconfirmed|0000-00-00 00:00:00         |2004-12-13 16:07:23
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18958

[Bug libfortran/18958] eoshift segfaults when shifting off the end of an array

[Thomas dot Koenig at online dot de]

------- Additional Comments From Thomas dot Koenig at online dot de  2005-03-09 15:13 -------
$ cat eoshift.f90
  print *,eoshift((/1, 3/), 3)
end
$ gfortran eoshift.f90
$ ./a.out
Segmentation fault

This fails because the loop

      for (n = 0; n < len; n++)
        {
          memcpy (dest, src, size);
          dest += roffset;
          src += soffset;
        }

at line 146 ff. in eoshift0.c runs over its bounds
with the test case, because both n and len are of type index_type,
index_type is size_t, which is unsigned, and len is supposed to be -1
(so it's either 0xffffffff or 0xffffffffffffffff, depending on
wether size_t is 32-bit or 64-bit).

This has an "easy", one-letter fix:  typedef index_type as ssize_t
instad of size_t in libgfortran.h.

This fixes the bug and causes no testsuite regressions.  It also
has the potential to fix other, latent bugs like this one. This is
also a design decision which I feel should be discussed on
the fortran mailing list.

It would require some configuration work for libgfortran (not
all systems have ssize_t), which I don't feel I can handle
competently at the moment, so I won't submit a patch (at least
not now).

Thomas

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18958

[Bug libfortran/18958] eoshift segfaults when shifting off the end of an array

[tkoenig at gcc dot gnu dot org]

------- Additional Comments From tkoenig at gcc dot gnu dot org  2005-04-10 22:21 -------
Patch here:

http://gcc.gnu.org/ml/fortran/2005-04/msg00300.html

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18958

[Bug libfortran/18958] eoshift segfaults when shifting off the end of an array

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2005-04-30 20:51 -------
Subject: Bug 18958

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	tkoenig@gcc.gnu.org	2005-04-30 20:51:39

Modified files:
	libgfortran    : libgfortran.h ChangeLog 
	gcc/testsuite  : ChangeLog 
Added files:
	gcc/testsuite/gfortran.dg: eoshift.f90 

Log message:
	2005-04-30  Thomas Koenig  <Thomas.Koenig@online.de>
	
	PR libfortran/18958
	libgfortran.h:  Change typedef of index_type from size_t
	to ssize_t.
	
	2005-04-30  Thomas Koenig  <Thomas.Koenig@online.de>
	
	PR libfortran/18958
	* gfortran.dg/eoshift.f90:  New test case.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libgfortran/libgfortran.h.diff?cvsroot=gcc&r1=1.23&r2=1.24
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libgfortran/ChangeLog.diff?cvsroot=gcc&r1=1.206&r2=1.207
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/ChangeLog.diff?cvsroot=gcc&r1=1.5419&r2=1.5420
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/gfortran.dg/eoshift.f90.diff?cvsroot=gcc&r1=NONE&r2=1.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18958

[Bug libfortran/18958] [4.0 only] eoshift segfaults when shifting off the end of an array

[tkoenig at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |4.0.0
      Known to work|                            |4.1.0
            Summary|eoshift segfaults when      |[4.0 only] eoshift segfaults
                   |shifting off the end of an  |when shifting off the end of
                   |array                       |an array
   Target Milestone|---                         |4.0.1


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18958

[Bug libfortran/18958] [4.0 only] eoshift segfaults when shifting off the end of an array

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2005-05-07 19:48 -------
Subject: Bug 18958

CVSROOT:	/cvs/gcc
Module name:	gcc
Branch: 	gcc-4_0-branch
Changes by:	tkoenig@gcc.gnu.org	2005-05-07 19:48:19

Modified files:
	libgfortran    : ChangeLog libgfortran.h 
	gcc/testsuite  : ChangeLog 
Added files:
	gcc/testsuite/gfortran.dg: eoshift.f90 

Log message:
	2005-05-06  Thomas Koenig  <Thomas.Koenig@online.de>
	
	Backport from mainline:
	PR libfortran/18958
	libgfortran.h:  Change typedef of index_type from size_t
	to ssize_t.
	
	2005-05-06  Thomas Koenig  <Thomas.Koenig@online.de>
	
	Backport from mainline:
	PR libfortran/18958
	* gfortran.dg/eoshift.f90:  New test case.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libgfortran/ChangeLog.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=1.163.2.23&r2=1.163.2.24
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libgfortran/libgfortran.h.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=1.23&r2=1.23.8.1
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/ChangeLog.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=1.5084.2.165&r2=1.5084.2.166
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/gfortran.dg/eoshift.f90.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=NONE&r2=1.1.4.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18958

[Bug libfortran/18958] [4.0 only] eoshift segfaults when shifting off the end of an array

[tkoenig at gcc dot gnu dot org]

------- Additional Comments From tkoenig at gcc dot gnu dot org  2005-05-07 19:49 -------
Fixed in the 4.0 branch. Closing.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18958