public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug fortran/94048] ICE and other problems using rank intrinsic to set array size
[not found] <bug-94048-4@http.gcc.gnu.org/bugzilla/>
@ 2020-04-14 19:41 ` jrfsousa at gmail dot com
2020-04-14 19:45 ` jrfsousa at gmail dot com
` (2 subsequent siblings)
3 siblings, 0 replies; 4+ messages in thread
From: jrfsousa at gmail dot com @ 2020-04-14 19:41 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94048
--- Comment #1 from José Rui Faustino de Sousa <jrfsousa at gmail dot com> ---
Created attachment 48273
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48273&action=edit
The cleaned-up version with pointer and bind(c) tests
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug fortran/94048] ICE and other problems using rank intrinsic to set array size
[not found] <bug-94048-4@http.gcc.gnu.org/bugzilla/>
2020-04-14 19:41 ` [Bug fortran/94048] ICE and other problems using rank intrinsic to set array size jrfsousa at gmail dot com
@ 2020-04-14 19:45 ` jrfsousa at gmail dot com
2020-07-23 16:33 ` dominiq at lps dot ens.fr
2021-06-16 12:42 ` jrfsousa at gcc dot gnu.org
3 siblings, 0 replies; 4+ messages in thread
From: jrfsousa at gmail dot com @ 2020-04-14 19:45 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94048
--- Comment #2 from José Rui Faustino de Sousa <jrfsousa at gmail dot com> ---
Please ignore the last attachment I mixed up the bug report...
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug fortran/94048] ICE and other problems using rank intrinsic to set array size
[not found] <bug-94048-4@http.gcc.gnu.org/bugzilla/>
2020-04-14 19:41 ` [Bug fortran/94048] ICE and other problems using rank intrinsic to set array size jrfsousa at gmail dot com
2020-04-14 19:45 ` jrfsousa at gmail dot com
@ 2020-07-23 16:33 ` dominiq at lps dot ens.fr
2021-06-16 12:42 ` jrfsousa at gcc dot gnu.org
3 siblings, 0 replies; 4+ messages in thread
From: dominiq at lps dot ens.fr @ 2020-07-23 16:33 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94048
Dominique d'Humieres <dominiq at lps dot ens.fr> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |NEW
Last reconfirmed| |2020-07-23
Ever confirmed|0 |1
--- Comment #3 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
Confirmed since at least GCC7. My instrumented compiler gives
../../work/gcc/fortran/expr.c:3278:37: runtime error: index 15 out of bounds
for type 'gfc_expr *[15]'
../../work/gcc/fortran/expr.c:3280:35: runtime error: index 15 out of bounds
for type 'gfc_expr *[15]'
../../work/gcc/fortran/expr.c:3282:38: runtime error: index 15 out of bounds
for type 'gfc_expr *[15]'
=================================================================
==16543==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x617000004260 at pc 0x000100140461 bp 0x7ffeefbfe570 sp 0x7ffeefbfe568
READ of size 8 at 0x617000004260 thread T0
#0 0x100140460 in check_references(gfc_ref*, bool (*)(gfc_expr*))
expr.c:3282
#1 0x100160c06 in check_restricted(gfc_expr*) expr.c:3394
#2 0x10016fc77 in restricted_args(gfc_actual_arglist*) expr.c:3157
#3 0x10016fd1c in restricted_intrinsic(gfc_expr*) expr.c:3245
#4 0x100160923 in check_restricted(gfc_expr*) expr.c:3356
#5 0x100160067 in gfc_specification_expr(gfc_expr*) expr.c:3497
#6 0x100017254 in resolve_array_bound(gfc_expr*, int) array.c:379
#7 0x10001e426 in gfc_resolve_array_spec(gfc_array_spec*, int) array.c:422
#8 0x10040013c in resolve_symbol(gfc_symbol*) resolve.c:15922
#9 0x1003f8ccd in resolve_symbol(gfc_symbol*) resolve.c:15334
#10 0x1004f2aa6 in do_traverse_symtree(gfc_symtree*, void
(*)(gfc_symtree*), void (*)(gfc_symbol*)) symbol.c:4170
#11 0x100511004 in gfc_traverse_ns(gfc_namespace*, void (*)(gfc_symbol*))
symbol.c:4195
#12 0x100454636 in resolve_types(gfc_namespace*) resolve.c:17211
#13 0x1003f3e32 in gfc_resolve(gfc_namespace*) resolve.c:17326
#14 0x100375344 in gfc_parse_file() parse.c:6448
#15 0x10055baf3 in gfc_be_parse_file() f95-lang.c:212
#16 0x106bdcb9c in compile_file() toplev.c:458
#17 0x106bebc34 in do_compile() toplev.c:2307
#18 0x10a663058 in toplev::main(int, char**) toplev.c:2446
#19 0x10ac0eea4 in main main.c:39
#20 0x7fff6e3decc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)
0x617000004260 is located 0 bytes to the right of 736-byte region
[0x617000003f80,0x617000004260)
allocated by thread T0 here:
#0 0x15bc6200f in wrap_calloc sanitizer_flags.h:38
#1 0x1098e04ca in xcalloc xmalloc.c:162
#2 0x100436be1 in resolve_actual_arglist(gfc_actual_arglist*,
procedure_type, bool) resolve.c:2069
#3 0x100413232 in resolve_function(gfc_expr*) resolve.c:3208
#4 0x100416423 in gfc_resolve_expr(gfc_expr*) resolve.c:7056
#5 0x100017234 in resolve_array_bound(gfc_expr*, int) array.c:378
#6 0x10001e426 in gfc_resolve_array_spec(gfc_array_spec*, int) array.c:422
#7 0x10040013c in resolve_symbol(gfc_symbol*) resolve.c:15922
#8 0x1003f8ccd in resolve_symbol(gfc_symbol*) resolve.c:15334
#9 0x1004f2aa6 in do_traverse_symtree(gfc_symtree*, void (*)(gfc_symtree*),
void (*)(gfc_symbol*)) symbol.c:4170
#10 0x100511004 in gfc_traverse_ns(gfc_namespace*, void (*)(gfc_symbol*))
symbol.c:4195
#11 0x100454636 in resolve_types(gfc_namespace*) resolve.c:17211
#12 0x1003f3e32 in gfc_resolve(gfc_namespace*) resolve.c:17326
#13 0x100375344 in gfc_parse_file() parse.c:6448
#14 0x10055baf3 in gfc_be_parse_file() f95-lang.c:212
#15 0x106bdcb9c in compile_file() toplev.c:458
#16 0x106bebc34 in do_compile() toplev.c:2307
#17 0x10a663058 in toplev::main(int, char**) toplev.c:2446
#18 0x10ac0eea4 in main main.c:39
#19 0x7fff6e3decc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)
SUMMARY: AddressSanitizer: heap-buffer-overflow expr.c:3282 in
check_references(gfc_ref*, bool (*)(gfc_expr*))
Shadow bytes around the buggy address:
0x1c2e000007f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1c2e00000800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1c2e00000810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1c2e00000820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1c2e00000830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x1c2e00000840: 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa
0x1c2e00000850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c2e00000860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c2e00000870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c2e00000880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x1c2e00000890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==16543==ABORTING
f951: internal compiler error: Abort trap: 6
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug fortran/94048] ICE and other problems using rank intrinsic to set array size
[not found] <bug-94048-4@http.gcc.gnu.org/bugzilla/>
` (2 preceding siblings ...)
2020-07-23 16:33 ` dominiq at lps dot ens.fr
@ 2021-06-16 12:42 ` jrfsousa at gcc dot gnu.org
3 siblings, 0 replies; 4+ messages in thread
From: jrfsousa at gcc dot gnu.org @ 2021-06-16 12:42 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94048
José Rui Faustino de Sousa <jrfsousa at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #4 from José Rui Faustino de Sousa <jrfsousa at gcc dot gnu.org> ---
Fixed by PR96726
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-06-16 12:42 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <bug-94048-4@http.gcc.gnu.org/bugzilla/>
2020-04-14 19:41 ` [Bug fortran/94048] ICE and other problems using rank intrinsic to set array size jrfsousa at gmail dot com
2020-04-14 19:45 ` jrfsousa at gmail dot com
2020-07-23 16:33 ` dominiq at lps dot ens.fr
2021-06-16 12:42 ` jrfsousa at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).