[Bug libfortran/23321] New: Direct unformatted read beyond EOF cores

[Bug libfortran/23321] New: Direct unformatted read beyond EOF cores

[bsp at kithrup dot com]

c  Summary: Direct unformatted read beyond EOF cores

c  This program demonstrates a bug in gfortran/libgfortran.
c  The bug is that a
c  program dumps core when reading beyond the end of
c  a access='direct', form='unformatted' file instead
c  of transfering control to 'err=' label.
c  Also, returns incorrectly when reading at end of file.

c  To test
c    dd if=/dev/zero of=shortfile bs=11811 count=1
c    ./a.out
c    Bus error (core dumped)
c    dd if=/dev/zero of=shortfile bs=11812 count=1
c    ./a.out
c    should not get here
c    before 779 inbuf(1)=   32
c    STOP 0

c    Note: in the above case, the value of inbuf(1) got set to a space

c  When compiled with ifort or g77, the correct output is produced
c  in both cases.
c    ./a.out
c    at 779, all is good

c  Problem occurs in
c    GNU Fortran 95 (GCC 4.0.1)
c    GNU Fortran 95 (GCC 4.0.2 20050804 (prerelease))
c    GNU Fortran 95 (GCC 4.1.0 20050806 (experimental))

c gfortran -v
c Using built-in specs.
c Target: i686-pc-linux-gnu
c Configured with: ../../NetSrc/gcc-4.1-20050806/configure --prefix=/home/bswift/afrl/
builddev/NetInst/gcc-4.1-20050806 --enable-languages=c,f95 --with-gmp=/home/bswift/afrl/
builddev/NetInst/gmp-4.1.4 --with-mpfr=/home/bswift/afrl/builddev/NetInst/mpfr-2.1.2
c Thread model: posix
c gcc version 4.1.0 20050806 (experimental)

      implicit none

      integer    nbytes

      integer inbuflen
      parameter (inbuflen=32768)
      integer*1      inbuf(inbuflen)
      integer k

      inbuf(1)=5

      nbytes=11812

      open(35,file='shortfile',access='direct',recl=nbytes,form
     $     ='unformatted')

      read(35,rec=2,err=779) (inbuf(k),k=1,nbytes)

      write(*,*) 'should not get here'
      write(*,*) 'before 779 inbuf(1)=',inbuf(1)
      stop
 779  write(*,*) 'at 779, all is good'
      end

-- 
           Summary: Direct unformatted read beyond EOF cores
           Product: gcc
           Version: 4.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libfortran
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: bsp at kithrup dot com
                CC: gcc-bugs at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23321

[Bug libfortran/23321] Direct unformatted read beyond EOF cores

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-08-11 13:31 -------
Confirmed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
   Last reconfirmed|0000-00-00 00:00:00         |2005-08-11 13:31:45
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23321

[Bug libfortran/23321] Direct unformatted read beyond EOF cores

[tkoenig at gcc dot gnu dot org]

------- Additional Comments From tkoenig at gcc dot gnu dot org  2005-08-14 21:39 -------
If HAVE_MMAP is undefined, then the test case gets to
"should not get here", so this is buggy as well.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23321

[Bug libfortran/23321] Direct unformatted read beyond EOF cores

[tkoenig at gcc dot gnu dot org]

------- Additional Comments From tkoenig at gcc dot gnu dot org  2005-08-15 22:12 -------
Proposed fix:

Index: transfer.c
===================================================================
RCS file: /cvs/gcc/gcc/libgfortran/io/transfer.c,v
retrieving revision 1.52
diff -c -p -r1.52 transfer.c
*** transfer.c  9 Aug 2005 01:56:04 -0000       1.52
--- transfer.c  15 Aug 2005 22:05:20 -0000
*************** data_transfer_init (int read_flag)
*** 1163,1168 ****
--- 1163,1177 ----
        if (g.mode == READING && current_unit->mode  == WRITING)
         flush(current_unit->s);

+       /* Check whether the record number exists on reading.  */
+
+       if (g.mode == READING
+         && ioparm.rec * current_unit->recl > file_length (current_unit->s))
+       {
+         generate_error (ERROR_BAD_OPTION, "Non-existing record number");
+         return;
+       }
+
        /* Position the file.  */
        if (sseek (current_unit->s,
               (ioparm.rec - 1) * current_unit->recl) == FAILURE)

Regression testing etc. to follow.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23321

[Bug libfortran/23321] Direct unformatted read beyond EOF cores

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2005-09-04 20:36 -------
Subject: Bug 23321

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	tkoenig@gcc.gnu.org	2005-09-04 20:36:52

Modified files:
	libgfortran    : ChangeLog 
	libgfortran/io : transfer.c 
	gcc/testsuite  : ChangeLog 
Added files:
	gcc/testsuite/gfortran.dg: direct_io_4.f90 

Log message:
	2005-09-04  Thomas Koenig  <Thomas.Koenig@online.de>
	
	PR libfortran/23321
	* io/transfer.c(data_transfer_init):  Check for a too-large
	record number.  Return if sseek failed.
	
	2005-09-04  Thomas Koenig  <Thomas.Koenig@online.de>
	
	PR libfortran/23321
	* gfortran.dg/direct_io_4.f90:  New test case.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libgfortran/ChangeLog.diff?cvsroot=gcc&r1=1.293&r2=1.294
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libgfortran/io/transfer.c.diff?cvsroot=gcc&r1=1.55&r2=1.56
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/ChangeLog.diff?cvsroot=gcc&r1=1.6004&r2=1.6005
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/gfortran.dg/direct_io_4.f90.diff?cvsroot=gcc&r1=NONE&r2=1.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23321

[Bug libfortran/23321] Direct unformatted read beyond EOF cores

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2005-09-04 20:45 -------
Subject: Bug 23321

CVSROOT:	/cvs/gcc
Module name:	gcc
Branch: 	gcc-4_0-branch
Changes by:	tkoenig@gcc.gnu.org	2005-09-04 20:45:41

Modified files:
	libgfortran    : ChangeLog 
	libgfortran/io : transfer.c 
	gcc/testsuite  : ChangeLog 
Added files:
	gcc/testsuite/gfortran.dg: direct_io_4.f90 

Log message:
	2005-09-04  Thomas Koenig  <Thomas.Koenig@online.de>
	
	PR libfortran/23321
	* io/transfer.c(data_transfer_init):  Check for a too-large
	record number.  Return if sseek failed.
	
	2005-09-04  Thomas Koenig  <Thomas.Koenig@online.de>
	
	PR libfortran/23321
	* gfortran.dg/direct_io_4.f90:  New test case.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libgfortran/ChangeLog.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=1.163.2.85&r2=1.163.2.86
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libgfortran/io/transfer.c.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=1.32.2.14&r2=1.32.2.15
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/ChangeLog.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=1.5084.2.375&r2=1.5084.2.376
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/gfortran.dg/direct_io_4.f90.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=NONE&r2=1.1.2.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23321

[Bug libfortran/23321] Direct unformatted read beyond EOF cores

[tkoenig at gcc dot gnu dot org]

------- Additional Comments From tkoenig at gcc dot gnu dot org  2005-09-04 20:50 -------
Fixed on mainline and 4.0.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23321

[Bug libfortran/23321] Direct unformatted read beyond EOF cores

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.0.2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23321