[Bug fortran/61632] Memory corruption on error when writing formatted data

["dominiq at lps dot ens.fr" <gcc-bugzilla at gcc dot gnu dot org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61632

--- Comment #12 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
A little bit less clumsy

   if (f != NULL)
-    fmt->format_string = f->source;
+    fmt->format_string_len = strrchr (f->source, ')') - f->source + 1;

I don't understand why

+    fmt->format_string_len = strchr (f->source, '\0') - f->source;

is not working. With the following "instrumentation"

  if (f != NULL)
    {
    fmt->format_string_len = strrchr (f->source, ')') - f->source + 1;
      if (strchr (f->source, '\0')-strrchr (f->source, ')')>1)
        printf("pos 0 =%x, pos ) =%x\n",strchr (f->source, '\0'),strrchr
(f->source, ')'));
    }

I get

pos 0 =c2c048c0, pos ) =c2c048b1
At line 8 of file pr61632_1_db_5.f90 (unit = 6, file = 'stdout')
Fortran runtime error: Expected REAL for item 2 in formatted transfer, got
CHARACTER
(A3,1PE13.5,2(A3))
      ^

for

      program p
      call ss()
      end program p
      subroutine ss
      CHARACTER(3), save :: ZTYP(4)
      DATA ZTYP /'WWW','XXX','YYY','ZZZ'/
      write(*,600) 'AAA','BBB',0.0,ZTYP
 600  FORMAT(A3,1PE13.5,2(A3))
      end subroutine ss

Any idea?