[Bug fortran/99147] New: Sanitizer detects heap-use-after-free in gfc_add_flavor

[Bug fortran/99147] New: Sanitizer detects heap-use-after-free in gfc_add_flavor

[zeccav at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99147

            Bug ID: 99147
           Summary: Sanitizer detects heap-use-after-free in
                    gfc_add_flavor
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zeccav at gmail dot com
  Target Milestone: ---

! trunk 150221 gfortran -fdec
! ERROR: AddressSanitizer: heap-use-after-free
! READ of size 1 at 0x613000001f18 thread T0
!    #0 0xe1a258 in gfc_add_flavor(symbol_attribute*, sym_flavor, char const*,
locus*) ../../gcc/gcc/fortran/symbol.c:1775
! symbol.c:1775 "if (gfc_new_block && gfc_new_block->abr_modproc_decl"
      TYPE :: t
      END TYPE
      END

[Bug fortran/99147] Sanitizer detects heap-use-after-free in gfc_add_flavor

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99147

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-02-18
             Status|UNCONFIRMED                 |NEW
                 CC|                            |anlauf at gcc dot gnu.org
           Priority|P3                          |P4
     Ever confirmed|0                           |1

--- Comment #1 from anlauf at gcc dot gnu.org ---
Confirmed using valgrind.

Simply reversing the conditions seems to resolve the issue:

diff --git a/gcc/fortran/symbol.c b/gcc/fortran/symbol.c
index 3b988d1be22..e982374d9d1 100644
--- a/gcc/fortran/symbol.c
+++ b/gcc/fortran/symbol.c
@@ -1772,8 +1772,8 @@ gfc_add_flavor (symbol_attribute *attr, sym_flavor f,
const char *name,
   /* Copying a procedure dummy argument for a module procedure in a
      submodule results in the flavor being copied and would result in
      an error without this.  */
-  if (gfc_new_block && gfc_new_block->abr_modproc_decl
-      && attr->flavor == f && f == FL_PROCEDURE)
+  if (attr->flavor == f && f == FL_PROCEDURE
+      && gfc_new_block && gfc_new_block->abr_modproc_decl)
     return true;

   if (attr->flavor != FL_UNKNOWN)

[Bug fortran/99147] Sanitizer detects heap-use-after-free in gfc_add_flavor

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99147

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |anlauf at gcc dot gnu.org

--- Comment #2 from anlauf at gcc dot gnu.org ---
Patch: https://gcc.gnu.org/pipermail/fortran/2021-February/055729.html

[Bug fortran/99147] Sanitizer detects heap-use-after-free in gfc_add_flavor

[zeccav at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99147

--- Comment #3 from Vittorio Zecca <zeccav at gmail dot com> ---
I changed symbol.c as per your suggestion and now the address
sanitized gfortran compiles fine.
Now I am going to check it against the testsuite.
Results tomorow.

[Bug fortran/99147] Sanitizer detects heap-use-after-free in gfc_add_flavor

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99147

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Harald Anlauf <anlauf@gcc.gnu.org>:

https://gcc.gnu.org/g:af027826292351218785f893d1c42fe28ae3ed9f

commit r11-7303-gaf027826292351218785f893d1c42fe28ae3ed9f
Author: Harald Anlauf <anlauf@gmx.de>
Date:   Fri Feb 19 20:21:27 2021 +0100

    PR fortran/99147 - Sanitizer detects heap-use-after-free in gfc_add_flavor

    Reverse order of conditions to avoid invalid read.

    gcc/fortran/ChangeLog:

            * symbol.c (gfc_add_flavor): Reverse order of conditions.

[Bug fortran/99147] Sanitizer detects heap-use-after-free in gfc_add_flavor

[zeccav at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99147

--- Comment #5 from Vittorio Zecca <zeccav at gmail dot com> ---
I ran the testsuite against the proposed fix and it was successful, no
sanitizer errors in symbol.c.

Only remaining error as in bug 99148.

[Bug fortran/99147] Sanitizer detects heap-use-after-free in gfc_add_flavor

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99147

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #6 from anlauf at gcc dot gnu.org ---
Fixed on master for gcc-11.  Closing.

Thanks for the report!