[Bug fortran/126945] New: ASAN reports heap-use-after-free at fortran/simplify.cc:133 when compiling gfortran.dg/pr46884.f since r17-3155-g31f66a84342926
"jamborm at gcc dot gnu.org via Gcc-bugs" <[email protected]>
| Newsgroups | gmane.comp.gcc.bugs |
|---|---|
| Message-ID | <[email protected]/bugzilla/> |
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126945
Bug ID: 126945
Summary: ASAN reports heap-use-after-free at
fortran/simplify.cc:133 when compiling
gfortran.dg/pr46884.f since r17-3155-g31f66a84342926
Product: gcc
Version: 17.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: fortran
Assignee: unassigned at gcc dot gnu.org
Reporter: jamborm at gcc dot gnu.org
CC: jvdelisle at gcc dot gnu.org
Blocks: 86656
Target Milestone: ---
Host: x86_64-linux
Target: x86_64-linux
With an ASAN-instrumented GCC (commit 5e96cff93ec):
export ASAN_OPTIONS=detect_leaks=0
configure --enable-languages=c,c++,fortran --enable-host-shared
--enable-checking=release --disable-multilib --with-build-config=bootstrap-asan
running
ASAN_OPTIONS=detect_leaks=0 make -k check-gfortran
RUNTESTFLAGS="dg.exp=pr46884.f"
produces
=================================================================
==1975389==ERROR: AddressSanitizer: heap-use-after-free on address
0x7c2ef13ea7c0 at pc 0x000000d0ddea bp 0x7ffe17db49c0 sp 0x7ffe17db49b8
READ of size 8 at 0x7c2ef13ea7c0 thread T0
#0 0x000000d0dde9 in gfc_resolve_substring(gfc_ref*, bool*)
/home/mjambor/gcc/mine/src/gcc/fortran/resolve.cc:5954
#1 0x000000d0e940 in gfc_resolve_ref(gfc_expr*)
/home/mjambor/gcc/mine/src/gcc/fortran/resolve.cc:6145
#2 0x000000cfef58 in resolve_variable
/home/mjambor/gcc/mine/src/gcc/fortran/resolve.cc:6730
#3 0x000000cfef58 in gfc_resolve_expr(gfc_expr*)
/home/mjambor/gcc/mine/src/gcc/fortran/resolve.cc:8288
#4 0x000000cfef58 in gfc_resolve_expr(gfc_expr*)
/home/mjambor/gcc/mine/src/gcc/fortran/resolve.cc:8244
#5 0x000000d11cd4 in resolve_actual_arglist
/home/mjambor/gcc/mine/src/gcc/fortran/resolve.cc:2253
#6 0x000000d135f0 in resolve_call
/home/mjambor/gcc/mine/src/gcc/fortran/resolve.cc:4258
#7 0x000000cd6be3 in gfc_resolve_code(gfc_code*, gfc_namespace*)
/home/mjambor/gcc/mine/src/gcc/fortran/resolve.cc:14711
#8 0x000000cdfcad in resolve_codes
/home/mjambor/gcc/mine/src/gcc/fortran/resolve.cc:20797
#9 0x000000ce0015 in gfc_resolve(gfc_namespace*, gfc_association_list*)
/home/mjambor/gcc/mine/src/gcc/fortran/resolve.cc:21081
#10 0x000000c95aa0 in resolve_all_program_units
/home/mjambor/gcc/mine/src/gcc/fortran/parse.cc:7637
#11 0x000000c95aa0 in gfc_parse_file()
/home/mjambor/gcc/mine/src/gcc/fortran/parse.cc:7904
#12 0x000000dc5980 in gfc_be_parse_file
/home/mjambor/gcc/mine/src/gcc/fortran/f95-lang.cc:249
#13 0x000002556f38 in compile_file
/home/mjambor/gcc/mine/src/gcc/toplev.cc:455
#14 0x00000086d1f4 in do_compile
/home/mjambor/gcc/mine/src/gcc/toplev.cc:2228
#15 0x00000086d1f4 in toplev::main(int, char**)
/home/mjambor/gcc/mine/src/gcc/toplev.cc:2396
#16 0x000000878bc9 in main /home/mjambor/gcc/mine/src/gcc/main.cc:39
#17 0x7fcef202b4fd in __libc_start_call_main (/lib64/libc.so.6+0x2b4fd)
(BuildId: 23df1cec07f2b2015212729aa5a415b57861b6fe)
#18 0x7fcef202b62a in __libc_start_main_alias_2 (/lib64/libc.so.6+0x2b62a)
(BuildId: 23df1cec07f2b2015212729aa5a415b57861b6fe)
#19 0x00000087b4e4 in _start ../sysdeps/x86_64/start.S:115
0x7c2ef13ea7c0 is located 0 bytes inside of 56-byte region
[0x7c2ef13ea7c0,0x7c2ef13ea7f8)
freed by thread T0 here:
#0 0x000000963daf in free
/home/mjambor/gcc/mine/src/libsanitizer/asan/asan_malloc_linux.cpp:51
#1 0x000000d88c52 in gfc_restore_last_undo_checkpoint()
/home/mjambor/gcc/mine/src/gcc/fortran/symbol.cc:4072
previously allocated by thread T0 here:
#0 0x000000964b2f in calloc
/home/mjambor/gcc/mine/src/libsanitizer/asan/asan_malloc_linux.cpp:74
#1 0x000006d8a964 in xcalloc
/home/mjambor/gcc/mine/src/libiberty/xmalloc.c:164
SUMMARY: AddressSanitizer: heap-use-after-free
/home/mjambor/gcc/mine/src/gcc/fortran/resolve.cc:5954 in
gfc_resolve_substring(gfc_ref*, bool*)
Shadow bytes around the buggy address:
0x7c2ef13ea500: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x7c2ef13ea580: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x7c2ef13ea600: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
0x7c2ef13ea680: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x7c2ef13ea700: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
=>0x7c2ef13ea780: fd fd fd fa fa fa fa fa[fd]fd fd fd fd fd fd fa
0x7c2ef13ea800: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
0x7c2ef13ea880: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd
0x7c2ef13ea900: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
0x7c2ef13ea980: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x7c2ef13eaa00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1975389==ABORTING
compiler exited with status 1
FAIL: gfortran.dg/pr46884.f -O 3 blank line(s) in output
I have bisected the failure to r17-3155-g31f66a84342926:
31f66a843429269ee9cdc6ce69ba3ff698773a35 is the first 'bad' commit
commit 31f66a843429269ee9cdc6ce69ba3ff698773a35
Author: Jerry DeLisle <[email protected]>
Date: Sat Aug 8 08:59:16 2026 -0700
fortran: [PR47425] Array constructor fails with length type expr
Two separate problems are fixed here. The original test case is fixed
by the one-liner in trans-array.cc. Add check for INTEGER_CST. The
remaining problem starts with parsing and not keeping track of charlens
where some of the charlens are created and later left dangling. Code was
added to keep track of these and remove them as needed.
PR fortran/47425
gcc/fortran/ChangeLog:
* decl.cc (discard_pending_charlen): Use new helper
function.
(discard_pending_charlens): Likewise.
(build_struct): Likewise.
* gfortran.h (struct gfc_charlen): Add a namespace
pointer to track char len for undo.
(struct gfc_undo_change_set): Add cls
pointer to track charlens created during parsing.
(struct gfc_undo_change_set): Add vec<gfc_charlen *> cls.
(gfc_remove_saved_charlen): Declare new helper function.
* parse.cc (accept_statement): Adjust comment.
* symbol.cc (gfc_merge_new_implicit): Use new helper function
(free_undo_change_set_data): Release cls.
(gfc_drop_last_undo_checkpoint): Splice cls into parent
changeset.
(gfc_restore_last_undo_checkpoint): Remove and free charlens
tracked in cls.
(gfc_commit_symbols): Truncate cls.
(gfc_remove_saved_charlen): New function to remove
previously saved char len.
(gfc_free_namespace): Remove charlens from undo before freeing
to prevent double-free.
(gfc_enforce_clean_symbol_state): Clear cls instead of asserting
empty; non-tentative callers leave charlens in cls.
* trans-array.cc (trans_array_constructor): Add guard.
gcc/testsuite/ChangeLog:
* gfortran.dg/pr47425-1.f90: New test.
* gfortran.dg/pr47425-2.f90: New test.
Referenced Bugs:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86656
[Bug 86656] [meta-bug] Issues found with -fsanitize=address