[Bug preprocessor/17131] New: memory corruption in preprocessor

[cato at df dot lth dot se]

The libstdc++ test suite tests have failed semi-randomly (dependent on
the path in which the gcc tree is located) on i386-unknown-netbsdelf2.0
since the tree-ssa merge.

I have tracked at least one of the failures to a memory corruption
in libcpp.  The test is 

  FAIL: 17_intro/header_cstdio.cc (test for excess errors)

that in this case fails with

  /gcctmp/gcc040820/gcc/libstdc++-v3/testsuite/17_intro/header_cstdio.cc:30:
error:  stray '\24' in program
  /gcctmp/gcc040820/gcc/libstdc++-v3/testsuite/17_intro/header_cstdio.cc:30:
error: expected `}' at end of input

The memory is corrupted at the line

      saved_cur_token[-1].type = pfile->cur_token[-1].type;

in the function _cpp_create_definition (libcpp/macro.c), when the
function is called the second time while processing .gch files
(see stack trace below).

The saved_cur_token points to the first element in an allocated
memory region, so the saved_cur_token[-1].type writes into the
memory buffer allocated before it, which happens to contain the
source code for the file to compile...

   /Krister


#0  _cpp_create_definition (pfile=0x85fc800, node=0x486a5850)
    at ../../gcc/libcpp/macro.c:1543
#1  0x084855d9 in cpp_read_state (r=0x85fc800, 
    name=0x85e2700
"/gcctmp/fcc040820/build/i386-unknown-netbsdelf2.0./libstdc++-v3/include/i386-unknown-netbsdelf2.0./bits/stdc++.h.gch/O0g.gch",

    f=0x4861e2b8, data=0x85e06f0) at ../../gcc/libcpp/pch.c:673
#2  0x081483cb in c_common_read_pch (pfile=0x85fc800, 
    name=0x85e2700
"/gcctmp/fcc040820/build/i386-unknown-netbsdelf2.0./libstdc++-v3/include/i386-unknown-netbsdelf2.0./bits/stdc++.h.gch/O0g.gch",
fd=8, 
    orig_name=0x85e5380
"/gcctmp/fcc040820/build/i386-unknown-netbsdelf2.0./libstdc++-v3/include/i386-unknown-netbsdelf2.0./bits/stdc++.h")
    at ../../gcc/gcc/c-pch.c:446
#3  0x0814956b in cb_read_pch (pfile=0x85fc800, 
    name=0x85e2700
"/gcctmp/fcc040820/build/i386-unknown-netbsdelf2.0./libstdc++-v3/include/i386-unknown-netbsdelf2.0./bits/stdc++.h.gch/O0g.gch",
fd=8, 
    orig_name=0x85e5380
"/gcctmp/fcc040820/build/i386-unknown-netbsdelf2.0./libstdc++-v3/include/i386-unknown-netbsdelf2.0./bits/stdc++.h")
    at ../../gcc/gcc/c-ppoutput.c:436
#4  0x0847e268 in should_stack_file (pfile=0x85fc800, file=0x85e2600, 
    import=0 '\0') at ../../gcc/libcpp/files.c:633
#5  0x0847e3ef in _cpp_stack_file (pfile=0x85fc800, file=0x85e2600, 
    import=0 '\0') at ../../gcc/libcpp/files.c:691
#6  0x0847e679 in _cpp_stack_include (pfile=0x85fc800, 
    fname=0xbfbffb2c "bits/stdc++.h", angle_brackets=0, type=IT_CMDLINE)
    at ../../gcc/libcpp/files.c:819
#7  0x0847ec2d in cpp_push_include (pfile=0x85fc800, 
    fname=0xbfbffb2c "bits/stdc++.h") at ../../gcc/libcpp/files.c:1107
#8  0x0814788b in push_command_line_include () at ../../gcc/gcc/c-opts.c:1353
#9  0x081471ca in c_common_init () at ../../gcc/gcc/c-opts.c:1059
#10 0x080c4743 in cxx_init () at ../../gcc/gcc/cp/lex.c:376
#11 0x083d5d22 in lang_dependent_init (
    name=0xbfbffb3a
"/gcctmp/fcc040820/gcc/libstdc++-v3/testsuite/17_intro/header_cstdio.cc") at
../../gcc/gcc/toplev.c:1963
#12 0x083d5ede in do_compile () at ../../gcc/gcc/toplev.c:2064
#13 0x083d5f6d in toplev_main (argc=27, argv=0xbfbff6e0)
    at ../../gcc/gcc/toplev.c:2097
#14 0x0815187f in main (argc=27, argv=0xbfbff6e0) at ../../gcc/gcc/main.c:35

-- 
           Summary: memory corruption in preprocessor
           Product: gcc
           Version: 3.5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: preprocessor
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: cato at df dot lth dot se
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i386-unknown-netbsdelf2.0
  GCC host triplet: i386-unknown-netbsdelf2.0
GCC target triplet: i386-unknown-netbsdelf2.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17131