procyberian/gcc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

PR fortran/95530, PR fortran/95537 - Buffer overflows with long symbols

Browse source 
The testcases for PR95090 and PR95106 trigger buffer overflows with long
symbols that were found with an instrumented compiler.  Enlarge the
affected buffers, and add checks that the buffers will suffice.

2020-06-05  Harald Anlauf  <anlauf@gmx.de>

gcc/fortran/
	PR fortran/95530
	PR fortran/95537
	* decl.c (gfc_match_decl_type_spec): Enlarge buffer, and enhance
	string copy to detect buffer overflow.
	* gfortran.h (gfc_common_head): Enlarge buffer.
	* trans-common.c (finish_equivalences): Enhance string copy to
	detect buffer overflow.
This commit is contained in:
Harald Anlauf 2020-06-05 20:30:34 +02:00
parent 608832716e
commit bcd96c9cce
3 changed files with 14 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
gcc/fortran/decl.c
View file

@ -4094,7 +4094,8 @@ match_byte_typespec (gfc_typespec *ts)
match
gfc_match_decl_type_spec (gfc_typespec *ts, int implicit_flag)
{
char name[GFC_MAX_SYMBOL_LEN + 1];
/* Provide sufficient space to hold "pdtsymbol". */
char name[GFC_MAX_SYMBOL_LEN + 1 + 3];
gfc_symbol *sym, *dt_sym;
match m;
char c;
@ -4284,7 +4285,11 @@ gfc_match_decl_type_spec (gfc_typespec *ts, int implicit_flag)
return m;
gcc_assert (!sym->attr.pdt_template && sym->attr.pdt_type);
ts->u.derived = sym;
strcpy (name, gfc_dt_lower_string (sym->name));
const char* lower = gfc_dt_lower_string (sym->name);
size_t len = strnlen (lower, sizeof (name));
gcc_assert (len < sizeof (name));
memcpy (name, lower, len);
name[len] = '\0';
}
if (sym && sym->attr.flavor == FL_STRUCT)

3
gcc/fortran/gfortran.h
View file

@ -1677,7 +1677,8 @@ typedef struct gfc_common_head
char use_assoc, saved, threadprivate;
unsigned char omp_declare_target : 1;
unsigned char omp_declare_target_link : 1;
char name[GFC_MAX_SYMBOL_LEN + 1];
/* Provide sufficient space to hold "symbol.eq.1234567890". */
char name[GFC_MAX_SYMBOL_LEN + 1 + 14];
struct gfc_symbol *head;
const char* binding_label;
int is_bind_c;

6
gcc/fortran/trans-common.c
View file

@ -1314,7 +1314,11 @@ finish_equivalences (gfc_namespace *ns)
c->where = ns->proc_name->declared_at;
else if (ns->is_block_data)
c->where = ns->sym_root->n.sym->declared_at;
strcpy (c->name, z->module);
size_t len = strlen (z->module);
gcc_assert (len < sizeof (c->name));
memcpy (c->name, z->module, len);
c->name[len] = '\0';
}
else
c = NULL;