public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "dominiq at lps dot ens.fr" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug fortran/94048] ICE and other problems using rank intrinsic to set array size Date: Thu, 23 Jul 2020 16:33:46 +0000 [thread overview] Message-ID: <bug-94048-4-L5m8IQsFCV@http.gcc.gnu.org/bugzilla/> (raw) In-Reply-To: <bug-94048-4@http.gcc.gnu.org/bugzilla/> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94048 Dominique d'Humieres <dominiq at lps dot ens.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |NEW Last reconfirmed| |2020-07-23 Ever confirmed|0 |1 --- Comment #3 from Dominique d'Humieres <dominiq at lps dot ens.fr> --- Confirmed since at least GCC7. My instrumented compiler gives ../../work/gcc/fortran/expr.c:3278:37: runtime error: index 15 out of bounds for type 'gfc_expr *[15]' ../../work/gcc/fortran/expr.c:3280:35: runtime error: index 15 out of bounds for type 'gfc_expr *[15]' ../../work/gcc/fortran/expr.c:3282:38: runtime error: index 15 out of bounds for type 'gfc_expr *[15]' ================================================================= ==16543==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000004260 at pc 0x000100140461 bp 0x7ffeefbfe570 sp 0x7ffeefbfe568 READ of size 8 at 0x617000004260 thread T0 #0 0x100140460 in check_references(gfc_ref*, bool (*)(gfc_expr*)) expr.c:3282 #1 0x100160c06 in check_restricted(gfc_expr*) expr.c:3394 #2 0x10016fc77 in restricted_args(gfc_actual_arglist*) expr.c:3157 #3 0x10016fd1c in restricted_intrinsic(gfc_expr*) expr.c:3245 #4 0x100160923 in check_restricted(gfc_expr*) expr.c:3356 #5 0x100160067 in gfc_specification_expr(gfc_expr*) expr.c:3497 #6 0x100017254 in resolve_array_bound(gfc_expr*, int) array.c:379 #7 0x10001e426 in gfc_resolve_array_spec(gfc_array_spec*, int) array.c:422 #8 0x10040013c in resolve_symbol(gfc_symbol*) resolve.c:15922 #9 0x1003f8ccd in resolve_symbol(gfc_symbol*) resolve.c:15334 #10 0x1004f2aa6 in do_traverse_symtree(gfc_symtree*, void (*)(gfc_symtree*), void (*)(gfc_symbol*)) symbol.c:4170 #11 0x100511004 in gfc_traverse_ns(gfc_namespace*, void (*)(gfc_symbol*)) symbol.c:4195 #12 0x100454636 in resolve_types(gfc_namespace*) resolve.c:17211 #13 0x1003f3e32 in gfc_resolve(gfc_namespace*) resolve.c:17326 #14 0x100375344 in gfc_parse_file() parse.c:6448 #15 0x10055baf3 in gfc_be_parse_file() f95-lang.c:212 #16 0x106bdcb9c in compile_file() toplev.c:458 #17 0x106bebc34 in do_compile() toplev.c:2307 #18 0x10a663058 in toplev::main(int, char**) toplev.c:2446 #19 0x10ac0eea4 in main main.c:39 #20 0x7fff6e3decc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8) 0x617000004260 is located 0 bytes to the right of 736-byte region [0x617000003f80,0x617000004260) allocated by thread T0 here: #0 0x15bc6200f in wrap_calloc sanitizer_flags.h:38 #1 0x1098e04ca in xcalloc xmalloc.c:162 #2 0x100436be1 in resolve_actual_arglist(gfc_actual_arglist*, procedure_type, bool) resolve.c:2069 #3 0x100413232 in resolve_function(gfc_expr*) resolve.c:3208 #4 0x100416423 in gfc_resolve_expr(gfc_expr*) resolve.c:7056 #5 0x100017234 in resolve_array_bound(gfc_expr*, int) array.c:378 #6 0x10001e426 in gfc_resolve_array_spec(gfc_array_spec*, int) array.c:422 #7 0x10040013c in resolve_symbol(gfc_symbol*) resolve.c:15922 #8 0x1003f8ccd in resolve_symbol(gfc_symbol*) resolve.c:15334 #9 0x1004f2aa6 in do_traverse_symtree(gfc_symtree*, void (*)(gfc_symtree*), void (*)(gfc_symbol*)) symbol.c:4170 #10 0x100511004 in gfc_traverse_ns(gfc_namespace*, void (*)(gfc_symbol*)) symbol.c:4195 #11 0x100454636 in resolve_types(gfc_namespace*) resolve.c:17211 #12 0x1003f3e32 in gfc_resolve(gfc_namespace*) resolve.c:17326 #13 0x100375344 in gfc_parse_file() parse.c:6448 #14 0x10055baf3 in gfc_be_parse_file() f95-lang.c:212 #15 0x106bdcb9c in compile_file() toplev.c:458 #16 0x106bebc34 in do_compile() toplev.c:2307 #17 0x10a663058 in toplev::main(int, char**) toplev.c:2446 #18 0x10ac0eea4 in main main.c:39 #19 0x7fff6e3decc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8) SUMMARY: AddressSanitizer: heap-buffer-overflow expr.c:3282 in check_references(gfc_ref*, bool (*)(gfc_expr*)) Shadow bytes around the buggy address: 0x1c2e000007f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1c2e00000800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1c2e00000810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1c2e00000820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1c2e00000830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x1c2e00000840: 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa 0x1c2e00000850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c2e00000860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c2e00000870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c2e00000880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c2e00000890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==16543==ABORTING f951: internal compiler error: Abort trap: 6
next prev parent reply other threads:[~2020-07-23 16:33 UTC|newest] Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top [not found] <bug-94048-4@http.gcc.gnu.org/bugzilla/> 2020-04-14 19:41 ` jrfsousa at gmail dot com 2020-04-14 19:45 ` jrfsousa at gmail dot com 2020-07-23 16:33 ` dominiq at lps dot ens.fr [this message] 2021-06-16 12:42 ` jrfsousa at gcc dot gnu.org
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-94048-4-L5m8IQsFCV@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).