Re: found an overlapping data buffer in file natGCInfo.cc

[David Daney <ddaney@caviumnetworks.com>]

Andrew Haley wrote:
> On 07/27/2009 10:29 AM, Martin Ettl wrote:
>> Hello,
>>
>> while checking the sources of gcc-4.4.1 with the static code analysis tool cppcheck i found an overlapping data buffer in file gcc-4.4.1/libjava/gnu/gcj/natGCInfo.cc at line 410. 
>>
>> Take a look at the file:
>>
>> static void *
>> nomem_handler(size_t size)
>> {
>>   if (oomDumpName)
>>     {
>>       char temp[strlen(oomDumpName) + 20];
>> 410   sprintf(temp, "%s%03d", temp, GC_dump_count++);

The second instance of temp should be oomDumpName.


>>       printf("nomem_handler(%zd) called\n", size);
>>       gc_ok--;
>>       GC_enumerator x(temp);
>>       x.enumerate();
>>       gc_ok++;
>>     }
>>   return (void*)0;
>> }
>>
>> Indeed, the buffer overlapps. This can lead to segmentation faults!
> 
> Thanks. How very weird; I wonder what that code was supposed to do.
> 

Someone should fix it.  If nobody does soon, I suppose I will as I added 
it in the first place.

David Daney