[Bug libfortran/126610] A correct list-directed READ of a NaN(...) value overflows libgfortran's fixed 300-byte scratch buffer, because the runtime alone chooses and mis-manages the buffer size

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D126610

--- Comment #2 from Arthur Chan <arthur.chan at adalogics dot com> ---
Apologies. I had originally meant to include the extra root-cause tracing s=
o as
to support a clearer description. The issue was found by an Anthropic agent,
and we verify it and rewrite the report manually from the original result we
were given. Here is a summary of the issue.

In libgfortran's list_read.c, the l_push_char function appends one characte=
r at
a time to line_buffer, which it allocates once at the fixed SCRATCH_SIZE of=
 300
bytes and thereafter never grows or bounds-checks.

The NaN branch of the read_real function then calls it for every character =
of a
parenthesised NaN payload, stopping only at the closing parenthesis, end of
input, or a separator, so the number of characters copied is decided by the
input rather than by the size of the buffer. Untrusted data containing more
than 300 characters can therefore overflow the buffer and cause an
out-of-bounds write.=