[Bug fortran/95828] New: ICE in resolve_select_rank, at fortran/resolve.c:9774

[Bug fortran/95828] New: ICE in resolve_select_rank, at fortran/resolve.c:9774

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95828

            Bug ID: 95828
           Summary: ICE in resolve_select_rank, at fortran/resolve.c:9774
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gscfq@t-online.de
  Target Milestone: ---

Happens between name length 58 (ok) and 59 (ICE) :


$ cat z1_58.f90
module m234567890123456789012345678901234567890123456789012345678
   type t234567890123456789012345678901234567890123456789012345678
   end type
contains
   subroutine s234567890123456789012345678901234567890123456789012345678 &
      (x234567890123456789012345678901234567890123456789012345678)
      type(t234567890123456789012345678901234567890123456789012345678) :: &
           x234567890123456789012345678901234567890123456789012345678(..)
      select rank (y234567890123456789012345678901234567890123456789012345678 &
        => x234567890123456789012345678901234567890123456789012345678)
      rank (2)
      rank (3)
      rank default
      end select
   end
end


$ cat z1_59.f90
module m2345678901234567890123456789012345678901234567890123456789
   type t2345678901234567890123456789012345678901234567890123456789
   end type
contains
   subroutine s2345678901234567890123456789012345678901234567890123456789 &
      (x2345678901234567890123456789012345678901234567890123456789)
      type(t2345678901234567890123456789012345678901234567890123456789) :: &
           x2345678901234567890123456789012345678901234567890123456789(..)
      select rank (y2345678901234567890123456789012345678901234567890123456789
&
        => x2345678901234567890123456789012345678901234567890123456789)
      rank (2)
      rank (3)
      rank default
      end select
   end
end


$ cat z1_63.f90
module m23456789012345678901234567890123456789012345678901234567890123
   type t23456789012345678901234567890123456789012345678901234567890123
   end type
contains
   subroutine s23456789012345678901234567890123456789012345678901234567890123 &
      (x23456789012345678901234567890123456789012345678901234567890123)
      type(t23456789012345678901234567890123456789012345678901234567890123) ::
&
           x23456789012345678901234567890123456789012345678901234567890123(..)
      select rank
(y23456789012345678901234567890123456789012345678901234567890123 &
        => x23456789012345678901234567890123456789012345678901234567890123)
      rank (2)
      rank (3)
      rank default
      end select
   end
end


$ gfortran-11-20200621 -c z1_58.f90
$
$ gfortran-11-20200621 -c z1_59.f90
f951: internal compiler error: Segmentation fault
0xbce57f crash_signal
        ../../gcc/toplev.c:328
0x6cb511 resolve_select_rank
        ../../gcc/fortran/resolve.c:9774
0x6cb511 gfc_resolve_code(gfc_code*, gfc_namespace*)
        ../../gcc/fortran/resolve.c:11973
0x6cc6f7 resolve_codes
        ../../gcc/fortran/resolve.c:17257
0x6cc62e resolve_codes
        ../../gcc/fortran/resolve.c:17240
0x6cc7be gfc_resolve(gfc_namespace*)
        ../../gcc/fortran/resolve.c:17292
0x6b46f2 gfc_parse_file()
        ../../gcc/fortran/parse.c:6448
0x70098f gfc_be_parse_file
        ../../gcc/fortran/f95-lang.c:212

[Bug fortran/95828] ICE in resolve_select_rank, at fortran/resolve.c:9774

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95828

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2020-06-23
                 CC|                            |anlauf at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
           Priority|P3                          |P4

--- Comment #1 from anlauf at gcc dot gnu.org ---
There's a first buffer overflow, fixed by:

diff --git a/gcc/fortran/resolve.c b/gcc/fortran/resolve.c
index c53b312f7ed..cc8676b3e03 100644
--- a/gcc/fortran/resolve.c
+++ b/gcc/fortran/resolve.c
@@ -9638,7 +9638,7 @@ resolve_select_rank (gfc_code *code, gfc_namespace
*old_ns)
   gfc_namespace *ns;
   gfc_code *body, *new_st, *tail;
   gfc_case *c;
-  char tname[GFC_MAX_SYMBOL_LEN];
+  char tname[GFC_MAX_SYMBOL_LEN + 7];
   char name[2 * GFC_MAX_SYMBOL_LEN];
   gfc_symtree *st;
   gfc_expr *selector_expr = NULL;

However, there's another one elsewhere that probably needs an instrumented
f951.

[Bug fortran/95828] ICE in resolve_select_rank, at fortran/resolve.c:9774

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95828

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |anlauf at gcc dot gnu.org

--- Comment #2 from anlauf at gcc dot gnu.org ---
This one is needed to match the resolve.c part:

diff --git a/gcc/fortran/match.c b/gcc/fortran/match.c
index 8063fcad295..b011634792e 100644
--- a/gcc/fortran/match.c
+++ b/gcc/fortran/match.c
@@ -6496,7 +6496,7 @@ static void
 select_rank_set_tmp (gfc_typespec *ts, int *case_value)
 {
   char name[2 * GFC_MAX_SYMBOL_LEN];
-  char tname[GFC_MAX_SYMBOL_LEN];
+  char tname[GFC_MAX_SYMBOL_LEN + 7];
   gfc_symtree *tmp;
   gfc_symbol *selector = select_type_stack->selector;
   gfc_symbol *sym;

Taking.

[Bug fortran/95828] ICE in resolve_select_rank, at fortran/resolve.c:9774

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95828

--- Comment #3 from anlauf at gcc dot gnu.org ---
Patch posted: https://gcc.gnu.org/pipermail/fortran/2020-June/054604.html

[Bug fortran/95828] ICE in resolve_select_rank, at fortran/resolve.c:9774

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95828

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Harald Anlauf <anlauf@gcc.gnu.org>:

https://gcc.gnu.org/g:77d455ee81ec3a23f8b20259a31ab963716f8e82

commit r11-1667-g77d455ee81ec3a23f8b20259a31ab963716f8e82
Author: Harald Anlauf <anlauf@gmx.de>
Date:   Thu Jun 25 20:34:48 2020 +0200

    PR fortran/95828 - Buffer overflows with SELECT RANK

    With SELECT RANK, name mangling results in long internal symbols that
    overflows internal buffers.  Fix that.

    gcc/fortran/
            PR fortran/95828
            * match.c (select_rank_set_tmp): Enlarge internal buffer used in
            generating a mangled name.
            * resolve.c (resolve_select_rank): Likewise.

[Bug fortran/95828] ICE in resolve_select_rank, at fortran/resolve.c:9774

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95828

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Harald Anlauf
<anlauf@gcc.gnu.org>:

https://gcc.gnu.org/g:5e00a2d1aa68f92e413fec01ce912401bcfcf44f

commit r10-8374-g5e00a2d1aa68f92e413fec01ce912401bcfcf44f
Author: Harald Anlauf <anlauf@gmx.de>
Date:   Thu Jun 25 20:34:48 2020 +0200

    PR fortran/95828 - Buffer overflows with SELECT RANK

    With SELECT RANK, name mangling results in long internal symbols that
    overflows internal buffers.  Fix that.

    gcc/fortran/
            PR fortran/95828
            * match.c (select_rank_set_tmp): Enlarge internal buffer used in
            generating a mangled name.
            * resolve.c (resolve_select_rank): Likewise.

    (cherry picked from commit 77d455ee81ec3a23f8b20259a31ab963716f8e82)

[Bug fortran/95828] ICE in resolve_select_rank, at fortran/resolve.c:9774

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95828

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #6 from anlauf at gcc dot gnu.org ---
FIXED on master for gcc-11 and on 10-branch.

Thanks for the report!