PR fortran/99147 - Sanitizer detects heap-use-after-free in gfc_add_flavor

Message ID trinity-ba957585-31b4-421f-8f1f-650fb1f43158-1613682741374@3c-app-gmx-bap37
State New
Headers show
Series
  • PR fortran/99147 - Sanitizer detects heap-use-after-free in gfc_add_flavor
Related show

Commit Message

Kewen.Lin via Gcc-patches Feb. 18, 2021, 9:12 p.m.
Dear all,

the PR reports an issue detected with an ASAN instrumented compiler,
which can also be verified with valgrind.  It appears that the state
of gfc_new_block could be such that it should not be dereferenced.
Reversing the order of condition evaluation helped.

I failed to find out why this should happen, but then other places
in the code put dereferences of gfc_new_block behind other checks.
Simple things like initializing gfc_new_block with NULL in decl.c
did not help.

Regtested on x86_64-pc-linux-gnu.  No testcase added since the issue
can be found only with an instrumented compiler or valgrind.

I consider the patch to be obvious and trivial, but post it here
in case somebody wants to dig deeper.

OK for master?

Thanks,
Harald


PR fortran/99147 - Sanitizer detects heap-use-after-free in gfc_add_flavor

Reverse order of conditions to avoid invalid read.

gcc/fortran/ChangeLog:

	* symbol.c (gfc_add_flavor): Reverse order of conditions.

Comments

Kewen.Lin via Gcc-patches Feb. 19, 2021, 8:34 a.m. | #1
Hi Harald,

It looks 'obvious' to me too and is certainly OK for master.

Thanks

Paul


On Thu, 18 Feb 2021 at 21:30, Harald Anlauf via Fortran <fortran@gcc.gnu.org>
wrote:

> Dear all,

>

> the PR reports an issue detected with an ASAN instrumented compiler,

> which can also be verified with valgrind.  It appears that the state

> of gfc_new_block could be such that it should not be dereferenced.

> Reversing the order of condition evaluation helped.

>

> I failed to find out why this should happen, but then other places

> in the code put dereferences of gfc_new_block behind other checks.

> Simple things like initializing gfc_new_block with NULL in decl.c

> did not help.

>

> Regtested on x86_64-pc-linux-gnu.  No testcase added since the issue

> can be found only with an instrumented compiler or valgrind.

>

> I consider the patch to be obvious and trivial, but post it here

> in case somebody wants to dig deeper.

>

> OK for master?

>

> Thanks,

> Harald

>

>

> PR fortran/99147 - Sanitizer detects heap-use-after-free in gfc_add_flavor

>

> Reverse order of conditions to avoid invalid read.

>

> gcc/fortran/ChangeLog:

>

>         * symbol.c (gfc_add_flavor): Reverse order of conditions.

>

>


-- 
"If you can't explain it simply, you don't understand it well enough" -
Albert Einstein

Patch

diff --git a/gcc/fortran/symbol.c b/gcc/fortran/symbol.c
index 3b988d1be22..e982374d9d1 100644
--- a/gcc/fortran/symbol.c
+++ b/gcc/fortran/symbol.c
@@ -1772,8 +1772,8 @@  gfc_add_flavor (symbol_attribute *attr, sym_flavor f, const char *name,
   /* Copying a procedure dummy argument for a module procedure in a
      submodule results in the flavor being copied and would result in
      an error without this.  */
-  if (gfc_new_block && gfc_new_block->abr_modproc_decl
-      && attr->flavor == f && f == FL_PROCEDURE)
+  if (attr->flavor == f && f == FL_PROCEDURE
+      && gfc_new_block && gfc_new_block->abr_modproc_decl)
     return true;

   if (attr->flavor != FL_UNKNOWN)