Bug 92174 - runtime error: index 15 out of bounds for type 'gfc_expr *[15]
Summary: runtime error: index 15 out of bounds for type 'gfc_expr *[15]
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: fortran (show other bugs)
Version: 10.0
: P4 normal
Target Milestone: 9.3
Assignee: Martin Liška
URL:
Keywords:
Depends on:
Blocks: ubsan
  Show dependency treegraph
 
Reported: 2019-10-22 08:26 UTC by Martin Liška
Modified: 2019-10-24 08:53 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2019-10-24 00:00:00


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Liška 2019-10-22 08:26:14 UTC
Happens with UBSAN build in:

$ ./xgcc -B. /home/marxin/Programming/gcc/gcc/testsuite/gfortran.dg/pr91802.f90 -fcoarray=single
../../gcc/fortran/array.c:867:36: runtime error: index 15 out of bounds for type 'gfc_expr *[15]'
    #0 0x8b40d6 in gfc_set_array_spec(gfc_symbol*, gfc_array_spec*, locus*) ../../gcc/fortran/array.c:867
    #1 0x953b29 in attr_decl1 ../../gcc/fortran/decl.c:8521
    #2 0x95406c in attr_decl ../../gcc/fortran/decl.c:8582
    #3 0x9549f2 in gfc_match_codimension() ../../gcc/fortran/decl.c:8855
    #4 0xaf2ff4 in match_word ../../gcc/fortran/parse.c:65
    #5 0xaf4825 in decode_statement ../../gcc/fortran/parse.c:464
    #6 0xafaa00 in next_free ../../gcc/fortran/parse.c:1272
    #7 0xafb459 in next_statement ../../gcc/fortran/parse.c:1504
    #8 0xb03ad7 in parse_spec ../../gcc/fortran/parse.c:3902
    #9 0xb0d9d4 in parse_module ../../gcc/fortran/parse.c:6085
    #10 0xb0f9f4 in gfc_parse_file() ../../gcc/fortran/parse.c:6390
    #11 0xc7db45 in gfc_be_parse_file ../../gcc/fortran/f95-lang.c:208
    #12 0x23dbbc5 in compile_file ../../gcc/toplev.c:456
    #13 0x23e39ec in do_compile ../../gcc/toplev.c:2167
    #14 0x23e401b in toplev::main(int, char**) ../../gcc/toplev.c:2302
    #15 0x491ff6a in main ../../gcc/main.c:39
    #16 0x7fd8f53b3e0a in __libc_start_main ../csu/libc-start.c:308
    #17 0x89d1e9 in _start (/home/marxin/Programming/gcc2/objdir/gcc/f951+0x89d1e9)

../../gcc/fortran/array.c:868:36: runtime error: index 15 out of bounds for type 'gfc_expr *[15]'
    #0 0x8b42cf in gfc_set_array_spec(gfc_symbol*, gfc_array_spec*, locus*) ../../gcc/fortran/array.c:868
    #1 0x953b29 in attr_decl1 ../../gcc/fortran/decl.c:8521
    #2 0x95406c in attr_decl ../../gcc/fortran/decl.c:8582
    #3 0x9549f2 in gfc_match_codimension() ../../gcc/fortran/decl.c:8855
    #4 0xaf2ff4 in match_word ../../gcc/fortran/parse.c:65
    #5 0xaf4825 in decode_statement ../../gcc/fortran/parse.c:464
    #6 0xafaa00 in next_free ../../gcc/fortran/parse.c:1272
    #7 0xafb459 in next_statement ../../gcc/fortran/parse.c:1504
    #8 0xb03ad7 in parse_spec ../../gcc/fortran/parse.c:3902
    #9 0xb0d9d4 in parse_module ../../gcc/fortran/parse.c:6085
    #10 0xb0f9f4 in gfc_parse_file() ../../gcc/fortran/parse.c:6390
    #11 0xc7db45 in gfc_be_parse_file ../../gcc/fortran/f95-lang.c:208
    #12 0x23dbbc5 in compile_file ../../gcc/toplev.c:456
    #13 0x23e39ec in do_compile ../../gcc/toplev.c:2167
    #14 0x23e401b in toplev::main(int, char**) ../../gcc/toplev.c:2302
    #15 0x491ff6a in main ../../gcc/main.c:39
    #16 0x7fd8f53b3e0a in __libc_start_main ../csu/libc-start.c:308
    #17 0x89d1e9 in _start (/home/marxin/Programming/gcc2/objdir/gcc/f951+0x89d1e9)
...
Comment 1 kargl 2019-10-22 14:11:37 UTC
(In reply to Martin Liška from comment #0)
> Happens with UBSAN build in:
> 
> $ ./xgcc -B.
> /home/marxin/Programming/gcc/gcc/testsuite/gfortran.dg/pr91802.f90
> -fcoarray=single
> ../../gcc/fortran/array.c:867:36: runtime error: index 15 out of bounds for
> type 'gfc_expr *[15]'


What are you doing?  pr91802.f90 is a compile time test.
It cannot generate a runtime error.
Comment 2 Martin Liška 2019-10-22 14:14:55 UTC
(In reply to kargl from comment #1)
> (In reply to Martin Liška from comment #0)
> > Happens with UBSAN build in:
> > 
> > $ ./xgcc -B.
> > /home/marxin/Programming/gcc/gcc/testsuite/gfortran.dg/pr91802.f90
> > -fcoarray=single
> > ../../gcc/fortran/array.c:867:36: runtime error: index 15 out of bounds for
> > type 'gfc_expr *[15]'
> 
> 
> What are you doing?  pr91802.f90 is a compile time test.
> It cannot generate a runtime error.

It's a runtime error of the GCC compiler that compiles the test-case ;)
The error message is a bit misleading.
Comment 3 Steve Kargl 2019-10-22 14:22:04 UTC
On Tue, Oct 22, 2019 at 02:14:55PM +0000, marxin at gcc dot gnu.org wrote:
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92174
> 
> --- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
> (In reply to kargl from comment #1)
> > (In reply to Martin Liška from comment #0)
> > > Happens with UBSAN build in:
> > > 
> > > $ ./xgcc -B.
> > > /home/marxin/Programming/gcc/gcc/testsuite/gfortran.dg/pr91802.f90
> > > -fcoarray=single
> > > ../../gcc/fortran/array.c:867:36: runtime error: index 15 out of bounds for
> > > type 'gfc_expr *[15]'
> > 
> > 
> > What are you doing?  pr91802.f90 is a compile time test.
> > It cannot generate a runtime error.
> 
> It's a runtime error of the GCC compiler that compiles the test-case ;)
> The error message is a bit misleading.
> 

So, what does your tool do?  gfortran correctly diagnosis
that rank+corank > 15, issues an error, and exits.  What is
the problem?
Comment 4 Martin Liška 2019-10-22 14:55:25 UTC
(In reply to Steve Kargl from comment #3)
> On Tue, Oct 22, 2019 at 02:14:55PM +0000, marxin at gcc dot gnu.org wrote:
> > https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92174
> > 
> > --- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
> > (In reply to kargl from comment #1)
> > > (In reply to Martin Liška from comment #0)
> > > > Happens with UBSAN build in:
> > > > 
> > > > $ ./xgcc -B.
> > > > /home/marxin/Programming/gcc/gcc/testsuite/gfortran.dg/pr91802.f90
> > > > -fcoarray=single
> > > > ../../gcc/fortran/array.c:867:36: runtime error: index 15 out of bounds for
> > > > type 'gfc_expr *[15]'
> > > 
> > > 
> > > What are you doing?  pr91802.f90 is a compile time test.
> > > It cannot generate a runtime error.
> > 
> > It's a runtime error of the GCC compiler that compiles the test-case ;)
> > The error message is a bit misleading.
> > 
> 
> So, what does your tool do?  gfortran correctly diagnosis
> that rank+corank > 15, issues an error, and exits.  What is
> the problem?

Problem is that the compiler invokes an undefined behaviour for the source file.
You can see the same with the following patch:

diff --git a/gcc/fortran/array.c b/gcc/fortran/array.c
index 427110bee74..166caca8347 100644
--- a/gcc/fortran/array.c
+++ b/gcc/fortran/array.c
@@ -864,6 +864,7 @@ gfc_set_array_spec (gfc_symbol *sym, gfc_array_spec *as, locus *error_loc)
       sym->as->corank = as->corank;
       for (i = 0; i < as->corank; i++)
 	{
+	  gcc_assert (sym->as->rank + i < GFC_MAX_DIMENSIONS);
 	  sym->as->lower[sym->as->rank + i] = as->lower[i];
 	  sym->as->upper[sym->as->rank + i] = as->upper[i];
 	}

$ ./xgcc -B. /home/marxin/Programming/gcc/gcc/testsuite/gfortran.dg/pr91802.f90 -fcoarray=single
f951: internal compiler error: in gfc_set_array_spec, at fortran/array.c:867
0x880e62 gfc_set_array_spec(gfc_symbol*, gfc_array_spec*, locus*)
	/home/marxin/Programming/gcc/gcc/fortran/array.c:867
0x8b3f6d attr_decl1
	/home/marxin/Programming/gcc/gcc/fortran/decl.c:8521
0x8b4114 attr_decl
	/home/marxin/Programming/gcc/gcc/fortran/decl.c:8582
0x8b46f0 gfc_match_codimension()
	/home/marxin/Programming/gcc/gcc/fortran/decl.c:8855
0x93dd54 match_word
	/home/marxin/Programming/gcc/gcc/fortran/parse.c:65
0x93efcb decode_statement
	/home/marxin/Programming/gcc/gcc/fortran/parse.c:464
0x944185 next_free
	/home/marxin/Programming/gcc/gcc/fortran/parse.c:1272
0x944727 next_statement
	/home/marxin/Programming/gcc/gcc/fortran/parse.c:1504
0x947bf0 parse_spec
	/home/marxin/Programming/gcc/gcc/fortran/parse.c:3902
0x94b747 parse_module
	/home/marxin/Programming/gcc/gcc/fortran/parse.c:6085
0x94c15b gfc_parse_file()
	/home/marxin/Programming/gcc/gcc/fortran/parse.c:6390
0x9ad167 gfc_be_parse_file
	/home/marxin/Programming/gcc/gcc/fortran/f95-lang.c:208
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

Note that sym->as->lower is defined as:
  struct gfc_expr *lower[GFC_MAX_DIMENSIONS], *upper[GFC_MAX_DIMENSIONS];

Hope it's clear now? Thanks.
Comment 5 Martin Liška 2019-10-22 14:56:01 UTC
> Problem is that the compiler invokes an undefined behaviour for the source 
file.

More precisely, it's an out of bounds array access.
Comment 6 Steve Kargl 2019-10-22 16:11:03 UTC
On Tue, Oct 22, 2019 at 02:56:01PM +0000, marxin at gcc dot gnu.org wrote:
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92174
> 
> --- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
> > Problem is that the compiler invokes an undefined behaviour for the source 
> file.
> 
> More precisely, it's an out of bounds array access.
> 

Which is irrelevant as the gfortran diagnosis the
issue, issues an error meesage, and exits.
Comment 7 kargl 2019-10-22 18:19:31 UTC
Author: kargl
Date: Tue Oct 22 18:18:59 2019
New Revision: 277297

URL: https://gcc.gnu.org/viewcvs?rev=277297&root=gcc&view=rev
Log:
2019-10-22  Steven G. Kargl  <kargl@gcc.gnu.org>

	PR fortran/92174
	* decl.c (attr_decl1): Move check for F2018:C822 from here ...
	* array.c (gfc_set_array_spec): ... to here. 

Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/array.c
    trunk/gcc/fortran/decl.c
Comment 8 kargl 2019-10-22 18:39:02 UTC
Author: kargl
Date: Tue Oct 22 18:38:30 2019
New Revision: 277298

URL: https://gcc.gnu.org/viewcvs?rev=277298&root=gcc&view=rev
Log:
2019-10-22  Steven G. Kargl  <kargl@gcc.gnu.org>

	PR fortran/92174
	* decl.c (attr_decl1): Move check for F2018:C822 from here ...
	* array.c (gfc_set_array_spec): ... to here. 

Modified:
    branches/gcc-9-branch/gcc/fortran/ChangeLog
    branches/gcc-9-branch/gcc/fortran/array.c
    branches/gcc-9-branch/gcc/fortran/decl.c
Comment 9 kargl 2019-10-22 18:42:23 UTC
fixed on 9-branch and trunk.
Comment 10 Martin Liška 2019-10-23 08:49:28 UTC
(In reply to kargl from comment #9)
> fixed on 9-branch and trunk.

Thank you for the fix.
Comment 11 Martin Liška 2019-10-24 08:08:38 UTC
I see two more places where similar UBSAN happens, I'm testing a patch.
Comment 12 Martin Liška 2019-10-24 08:49:34 UTC
Author: marxin
Date: Thu Oct 24 08:49:02 2019
New Revision: 277367

URL: https://gcc.gnu.org/viewcvs?rev=277367&root=gcc&view=rev
Log:
Fix another UBSAN in Fortran coarray.

2019-10-24  Martin Liska  <mliska@suse.cz>

	PR fortran/92174
	* array.c (gfc_resolve_array_spec): Break the loop
	for out of bounds index.
	* resolve.c (is_non_constant_shape_array): Likewise.

Modified:
    trunk/gcc/fortran/ChangeLog
    trunk/gcc/fortran/array.c
    trunk/gcc/fortran/resolve.c
Comment 13 Martin Liška 2019-10-24 08:53:26 UTC
Fixed now, I'm not planning to make backports.