[Bug fortran/95998] gfc_typename use of static memory

["dominiq at lps dot ens.fr" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95998

--- Comment #3 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
> If we ever have three occurences of gfc_typename in a function list,
> like
>
>   foo (gfc_typename(a), gfc_typename(b), gfc_typename(c));
>
> we will get the wrong result for the third one.  We will also get
> a wrong result for
>
>   pa = gfc_typename(a);
>   pb = gfc_typename(b);
>   pc = gfc_typename(c);
>
> because then pa will point to the same memory as pc.

OK. I think I am now starting to understand how this proc works.

I have looked at the occurrences of gfc_typename, and AFAICT they appear only
once or twice within
the same gfc_error, except for (line 2303 in check.c)

     gfc_error ("The function passed as OPERATOR at %L has arguments of type "
                 "%s and %s but shall have type %s", &op->where,
                 gfc_typename (&formal->sym->ts),
                 gfc_typename (&formal->next->sym->ts), gfc_typename (a));

but 'a' is a gfc_expr, while 'formal->sym->ts', and 'formal->next->sym->ts' are
gfc_typespec, so different procs and it should be OK.

Note that presently gfc_typename is only called in error messages and potential
problems will
only show as strange errors.

However in noticed a potential buffer overflow with DEC extensions:

  static char buffer1[GFC_MAX_SYMBOL_LEN + 7];  /* 7 for "TYPE()" + '\0'.  */
  static char buffer2[GFC_MAX_SYMBOL_LEN + 7];

should be

  static char buffer1[GFC_MAX_SYMBOL_LEN + 8];  /* 8 for "UNION()" + '\0'.  */
  static char buffer2[GFC_MAX_SYMBOL_LEN + 8];