From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 253473857C62; Sun, 12 Jul 2020 08:46:52 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 253473857C62
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
 s=default; t=1594543612;
 bh=F9MsfRyNuXPQp4wOZw+1hUiyekt4khlH4ppLGQ+W2bA=;
 h=From:To:Subject:Date:In-Reply-To:References:From;
 b=Gq/WByof7DeZk03aenilDgwtCJTdXaprSnGRgC8UUHghAiVJRR/9DNXmc4jZwQXhn
 qht5BmQTigjNpQRru+NGy/FsggNFyJwQEtyipmdPWYLzzhhc83O5PgJ7A+X3TiIOEL
 vXKEqzZzL1vMIw1itC6TUbLV8I+yywvUGpbB8v14=
From: "dominiq at lps dot ens.fr" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug fortran/95998] gfc_typename use of static memory
Date: Sun, 12 Jul 2020 08:46:51 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: fortran
X-Bugzilla-Version: unknown
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: dominiq at lps dot ens.fr
X-Bugzilla-Status: WAITING
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-95998-4-TaBATHa6z3@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-95998-4@http.gcc.gnu.org/bugzilla/>
References: <bug-95998-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <http://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <http://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Sun, 12 Jul 2020 08:46:52 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D95998

--- Comment #3 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
> If we ever have three occurences of gfc_typename in a function list,
> like
>
>   foo (gfc_typename(a), gfc_typename(b), gfc_typename(c));
>
> we will get the wrong result for the third one.  We will also get
> a wrong result for
>
>   pa =3D gfc_typename(a);
>   pb =3D gfc_typename(b);
>   pc =3D gfc_typename(c);
>
> because then pa will point to the same memory as pc.

OK. I think I am now starting to understand how this proc works.

I have looked at the occurrences of gfc_typename, and AFAICT they appear on=
ly
once or twice within
the same gfc_error, except for (line 2303 in check.c)

     gfc_error ("The function passed as OPERATOR at %L has arguments of typ=
e "
                 "%s and %s but shall have type %s", &op->where,
                 gfc_typename (&formal->sym->ts),
                 gfc_typename (&formal->next->sym->ts), gfc_typename (a));

but 'a' is a gfc_expr, while 'formal->sym->ts', and 'formal->next->sym->ts'=
 are
gfc_typespec, so different procs and it should be OK.

Note that presently gfc_typename is only called in error messages and poten=
tial
problems will
only show as strange errors.

However in noticed a potential buffer overflow with DEC extensions:

  static char buffer1[GFC_MAX_SYMBOL_LEN + 7];  /* 7 for "TYPE()" + '\0'.  =
*/
  static char buffer2[GFC_MAX_SYMBOL_LEN + 7];

should be

  static char buffer1[GFC_MAX_SYMBOL_LEN + 8];  /* 8 for "UNION()" + '\0'. =
 */
  static char buffer2[GFC_MAX_SYMBOL_LEN + 8];=