Re: found an overlapping data buffer in file natGCInfo.cc

[David Daney <ddaney at caviumnetworks dot com>]

Andrew Haley wrote:
> On 07/27/2009 10:29 AM, Martin Ettl wrote:
> > Hello,
> >
> > while checking the sources of gcc-4.4.1 with the static code analysis tool cppcheck i found an overlapping data buffer in file gcc-4.4.1/libjava/gnu/gcj/natGCInfo.cc at line 410. 
> >
> > Take a look at the file:
> >
> > static void *
> > nomem_handler(size_t size)
> > {
> >   if (oomDumpName)
> >     {
> >       char temp[strlen(oomDumpName) + 20];
> > 410   sprintf(temp, "%s%03d", temp, GC_dump_count++);

The second instance of temp should be oomDumpName.


> >       printf("nomem_handler(%zd) called\n", size);
> >       gc_ok--;
> >       GC_enumerator x(temp);
> >       x.enumerate();
> >       gc_ok++;
> >     }
> >   return (void*)0;
> > }
> >
> > Indeed, the buffer overlapps. This can lead to segmentation faults!
>
> Thanks. How very weird; I wonder what that code was supposed to do.

Someone should fix it.  If nobody does soon, I suppose I will as I added 
it in the first place.

David Daney