[fortran] Fix a potential buffer overflow.

Steve Kargl sgk@troutmask.apl.washington.edu
Wed Feb 14 20:07:00 GMT 2007


I've committed the following patch under the obvious rule.

In short, a user defined derived type can be up GFC_MAX_SYMBOL_LEN
characters in length, which is currently set to 63.  The BT_DERIVED
case adds another 7 characters to constructed string.  So, the
hardcoded buffer lengths of 60 is insufficient to hold the derived
type name.


2007-02-14  Steven G. Kargl  <kargl@gcc.gnu.org>

        * misc.c (gfc_typename): Fix potential buffer overflow.

Index: misc.c
===================================================================
--- misc.c	(revision 121957)
+++ misc.c	(working copy)
@@ -152,7 +152,8 @@ gfc_basic_typename (bt type)
 const char *
 gfc_typename (gfc_typespec *ts)
 {
-  static char buffer1[60], buffer2[60]; /* FIXME:  Buffer overflow.  */
+  static char buffer1[GFC_MAX_SYMBOL_LEN + 7];  /* 7 for "TYPE()" + '\0'.  */
+  static char buffer2[GFC_MAX_SYMBOL_LEN + 7];
   static int flag = 0;
   char *buffer;
 
-- 
Steve



More information about the Fortran mailing list