[fortran] Fix a potential buffer overflow.
Steve Kargl
sgk@troutmask.apl.washington.edu
Wed Feb 14 20:07:00 GMT 2007
I've committed the following patch under the obvious rule.
In short, a user defined derived type can be up GFC_MAX_SYMBOL_LEN
characters in length, which is currently set to 63. The BT_DERIVED
case adds another 7 characters to constructed string. So, the
hardcoded buffer lengths of 60 is insufficient to hold the derived
type name.
2007-02-14 Steven G. Kargl <kargl@gcc.gnu.org>
* misc.c (gfc_typename): Fix potential buffer overflow.
Index: misc.c
===================================================================
--- misc.c (revision 121957)
+++ misc.c (working copy)
@@ -152,7 +152,8 @@ gfc_basic_typename (bt type)
const char *
gfc_typename (gfc_typespec *ts)
{
- static char buffer1[60], buffer2[60]; /* FIXME: Buffer overflow. */
+ static char buffer1[GFC_MAX_SYMBOL_LEN + 7]; /* 7 for "TYPE()" + '\0'. */
+ static char buffer2[GFC_MAX_SYMBOL_LEN + 7];
static int flag = 0;
char *buffer;
--
Steve
More information about the Fortran
mailing list