Bug report

[Carlo Wood]

On Fri, May 11, 2001 at 03:46:48PM +0530, Mukul Bansal wrote:
> We ( Abhishek Sharma & Mukul Bansal ) believe that we have found a bug in
> the gcc compiler (RedHat linux 7). The bug was found while developing a
> chess program.

> int* queen(int x)
>   {
>     static  int x1,q[30],i,p,o;
...
>       q[0]=j;
>        return q;
> }
...
> int mate(int turn)
> {
>   int *n,i,j,p,q,d,t[2][2];
>   int m[22];
...
>     for(j=0;j<=n[0];j++)   /* copying n to m */ 
>           m[j]=n[j]; 

Since 30 > 22, you are probably having a buffer overrun.
I suggest you start with adding the check:

     assert( n[0] < sizeof(m)/sizeof(m[0]) );
     for(j=0;j<=n[0];j++)   /* copying n to m */ 
       m[j]=n[j]; 

I didn't run the program - then you'd have had included a tar ball.
Just browsed though the source code.

-- 
Carlo Wood <carlo@alinoe.com>

PS I very much doubt this is a compiler bug, but even it is was
   then you must report it to RedHat, because version 2.96 was
   never released by the FSF.  See http://www.bugzilla.com/