diff mbox

[libgfortran] Bug 61632 - memory corruption when writing formatted data

Message ID 53C2FC94.4070008@charter.net
State New
Headers show

Commit Message

Jerry DeLisle July 13, 2014, 9:39 p.m. UTC 
Hi all,

This bug was caused by an access to an invalid pointer offset to the format
string. This was only a problem on the second error using the same format
string.  I suspect it has to do with caching the format strings.  Regardless,
the patch fixes this by using the fortran style string lengths to calculate the
position in the string where the error occurs.

Test case attached.

Regression tested on x86-64.

OK for trunk?

2014-07-12  Jerry DeLisle  <jvdelisle@gcc.gnu.org>

	PR libgfortran/61632
	* io/format.c (format_error): Avoid invalid string pointer by
	using the fortran string length values to generate error string.

Comments

Janne Blomqvist July 14, 2014, 9:48 a.m. UTC | #1 
On Mon, Jul 14, 2014 at 12:39 AM, Jerry DeLisle <jvdelisle@charter.net> wrote:
> Hi all,
>
> This bug was caused by an access to an invalid pointer offset to the format
> string. This was only a problem on the second error using the same format
> string.  I suspect it has to do with caching the format strings.  Regardless,
> the patch fixes this by using the fortran style string lengths to calculate the
> position in the string where the error occurs.
>
> Test case attached.
>
> Regression tested on x86-64.
>
> OK for trunk?

Ok, thanks.

>
> 2014-07-12  Jerry DeLisle  <jvdelisle@gcc.gnu.org>
>
>         PR libgfortran/61632
>         * io/format.c (format_error): Avoid invalid string pointer by
>         using the fortran string length values to generate error string.
diff mbox

Patch

Index: format.c
===================================================================
--- format.c	(revision 212420)
+++ format.c	(working copy)
@@ -1117,7 +1117,7 @@  parse_format_list (st_parameter_dt *dtp, bool *see
 void
 format_error (st_parameter_dt *dtp, const fnode *f, const char *message)
 {
-  int width, i, j, offset;
+  int width, i, offset;
 #define BUFLEN 300
   char *p, buffer[BUFLEN];
   format_data *fmt = dtp->u.p.fmt;
@@ -1130,13 +1130,10 @@  format_error (st_parameter_dt *dtp, const fnode *f
   else
     snprintf (buffer, BUFLEN, "%s\n", message);
 
-  j = fmt->format_string - dtp->format;
+  offset = dtp->format_len - fmt->format_string_len;
 
-  offset = (j > 60) ? j - 40 : 0;
+  width = dtp->format_len;
 
-  j -= offset;
-  width = dtp->format_len - offset;
-
   if (width > 80)
     width = 80;
 
@@ -1144,14 +1141,14 @@  format_error (st_parameter_dt *dtp, const fnode *f
 
   p = strchr (buffer, '\0');
 
-  memcpy (p, dtp->format + offset, width);
+  memcpy (p, dtp->format, width);
 
   p += width;
   *p++ = '\n';
 
   /* Show where the problem is */
 
-  for (i = 1; i < j; i++)
+  for (i = 1; i < offset; i++)
     *p++ = ' ';
 
   *p++ = '^';