Steve Kargl - [fortran] Fix a potential buffer overflow. (original) (raw)

This is the mail archive of the gcc-patches@gcc.gnu.orgmailing list for the GCC project.

• From: Steve Kargl
• To: fortran at gcc dot gnu dot org, gcc-patches at gcc dot gnu dot org
• Date: Wed, 14 Feb 2007 12:05:59 -0800
• Subject: [fortran] Fix a potential buffer overflow.

I've committed the following patch under the obvious rule.

In short, a user defined derived type can be up GFC_MAX_SYMBOL_LEN characters in length, which is currently set to 63. The BT_DERIVED case adds another 7 characters to constructed string. So, the hardcoded buffer lengths of 60 is insufficient to hold the derived type name.

2007-02-14 Steven G. Kargl kargl@gcc.gnu.org

    * misc.c (gfc_typename): Fix potential buffer overflow.

Index: misc.c

--- misc.c (revision 121957) +++ misc.c (working copy) @@ -152,7 +152,8 @@ gfc_basic_typename (bt type) const char * gfc_typename (gfc_typespec ts) { - static char buffer1[60], buffer2[60]; / FIXME: Buffer overflow. / + static char buffer1[GFC_MAX_SYMBOL_LEN + 7]; / 7 for "TYPE()" + '\0'. */ + static char buffer2[GFC_MAX_SYMBOL_LEN + 7]; static int flag = 0; char *buffer;

Steve