Bug 10810 - gcc-3.3 fails make check: buffer overrun in test_demangle.c
Summary: gcc-3.3 fails make check: buffer overrun in test_demangle.c
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: other (show other bugs)
Version: 3.3
: P3 normal
Target Milestone: 3.3.1
Assignee: Not yet assigned to anyone
URL:
Keywords:
: 8346 (view as bug list)
Depends on:
Blocks:
 
Reported: 2003-05-16 03:56 UTC by tenm078902
Modified: 2003-07-14 05:13 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2003-05-23 22:11:28


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description tenm078902 2003-05-16 03:56:00 UTC
make check fails at test-demangle line 791 as:
./test-demangle < ../../../libiberty/testsuite/demangle-expected
FAIL at line 791, style gnu:
in:  __cl__C11VHDLLibraryGt4PixX3Z11VHDLLibraryZ14VHDLLibraryRepZt4List1Z10VHDLEntity@
out:
exp: VHDLLibrary::operator()(PixX<VHDLLibrary, VHDLLibraryRep, List<VHDLEntity> >) const
./test-demangle: 649 tests, 1 failures

Release:
gcc-3.3

Environment:
HP-B2600 Workstation HPUX11.00 (hppa2.0w-hp-hpux11.00)

How-To-Repeat:
build gcc-3.3 and run make check
Comment 1 tenm078902 2003-05-16 03:56:00 UTC
Fix:
This test (line791) contains 80 chars, overruns the buffer in test-demangle.c

diff -u2 /home/tenma/gcc-3.3/libiberty/testsuite/test-demangle.c.\~1\~ /home/tenma/gcc-3.3/libiberty/testsuite/test-demangle.c
--- /home/tenma/gcc-3.3/libiberty/testsuite/test-demangle.c.~1~ Thu Sep 12 04:58:02 2002
+++ /home/tenma/gcc-3.3/libiberty/testsuite/test-demangle.c     Fri May 16 12:37:29 2003
@@ -38,5 +38,5 @@
 /* Safely read a single line of arbitrary length from standard input.  */

-#define LINELEN 80
+#define LINELEN 160

 static void
Comment 2 Andrew Pinski 2003-05-23 22:11:28 UTC
This should go into 3.3.1, it is an easy patch.
Comment 3 Andrew Pinski 2003-05-24 00:52:56 UTC
Cannot confirm but It is an obvious error. Still on mainline (20030523).
Comment 4 Wolfgang Bangerth 2003-05-24 01:08:33 UTC
Zack, I couldn't find where this file came from exactly, but you checked
it in. I think the one-line patch here is safe. Can you take care of this PR?

Thanks  
  W.
Comment 5 Zack Weinberg 2003-05-24 02:14:47 UTC
No.  The one-line patch is wrong.  Note the comment above the #define that
got changed: "read a single line *of arbitrary length* from standard input."
That LINELEN define is the *initial* buffer size; getline() is supposed to
enlarge its buffer as needed.

It appears that there is a fencepost error, where the buffer will be overflowed
by one character iff the input line is exactly as long as the buffer.  The
correct fix, then, would be this change, somewhat below:

-      if (count >= alloc)
+      if (count + 1 >= alloc)

I do not have time right now to test that, and I don't see the failure anyway;
could one of you try it and check it in if it works?

Comment 6 Andrew Pinski 2003-05-24 20:03:59 UTC
*** Bug 8346 has been marked as a duplicate of this bug. ***
Comment 7 dave 2003-05-24 20:57:56 UTC
Subject: Re: [Bug other/10810] gcc-3.3 fails make check: buffer overrun in tes

I'm at the summit for the next two days, then leave for Europe Monday
evening.  Could someone else try the suggested fix?

> 
> PLEASE REPLY TO gcc-bugzilla@gcc.gnu.org ONLY, *NOT* gcc-bugs@gcc.gnu.org.
> 
> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=10810
> 
> 
> pinskia@physics.uc.edu changed:
> 
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>                  CC|                            |dave.anglin@nrc.ca
> 
> 
> ------- Additional Comments From zack@gcc.gnu.org  2003-05-24 02:14 -------
> No.  The one-line patch is wrong.  Note the comment above the #define that
> got changed: "read a single line *of arbitrary length* from standard input."
> That LINELEN define is the *initial* buffer size; getline() is supposed to
> enlarge its buffer as needed.
> 
> It appears that there is a fencepost error, where the buffer will be
> overflowed
> by one character iff the input line is exactly as long as the buffer.  The
> correct fix, then, would be this change, somewhat below:
> 
> -      if (count >= alloc)
> +      if (count + 1 >= alloc)
> 
> I do not have time right now to test that, and I don't see the failure
> anyway;
> could one of you try it and check it in if it works?
> 
> 
> ------- Additional Comments From pinskia@physics.uc.edu  2003-05-24 20:03
> -------
> *** Bug 8346 has been marked as a duplicate of this bug. ***
> 
> 
> 
> ------- You are receiving this mail because: -------
> You are on the CC list for the bug, or are watching someone who is.
> 


Comment 8 dave 2003-05-25 12:14:08 UTC
Subject: Re: [Bug other/10810] gcc-3.3 fails make check: buffer overrun in tes

> by one character iff the input line is exactly as long as the buffer.  The
> correct fix, then, would be this change, somewhat below:
> 
> -      if (count >= alloc)
> +      if (count + 1 >= alloc)

This works.  Tested on hppa2.0-hp-hpux11.11 and hppa64-hp-hpux11.11.

Dave
Comment 9 John David Anglin 2003-06-05 17:50:54 UTC
See: <http://gcc.gnu.org/ml/gcc-patches/2003-06/msg00443.html>.