From f15db427e1f3ad0a415abbe08cbd53f80e5e6eb8 Mon Sep 17 00:00:00 2001
From: Jerry DeLisle <jvdelisle@gcc.gnu.org>
Date: Wed, 26 Dec 2007 03:37:01 +0000
Subject: [PATCH] transfer.c (read_sf): Check if readlen was less than the
requested number of bytes to read and if so...
2007-12-25 Jerry DeLisle <jvdelisle@gcc.gnu.org>
* io/transfer.c (read_sf): Check if readlen was less than the requested
number of bytes to read and if so, generate error.
From-SVN: r131177
---
libgfortran/ChangeLog | 5 +++++
libgfortran/io/transfer.c | 9 ++++++++-
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/libgfortran/ChangeLog b/libgfortran/ChangeLog
index 0db6850733c5..b4f77b77e217 100644
--- a/libgfortran/ChangeLog
+++ b/libgfortran/ChangeLog
@@ -1,3 +1,8 @@
+2007-12-25 Jerry DeLisle <jvdelisle@gcc.gnu.org>
+
+ * io/transfer.c (read_sf): Check if readlen was less than the requested
+ number of bytes to read and if so, generate error.
+
2007-12-25 Daniel Franke <franke.daniel@gmail.com>
PR fortran/34533
diff --git a/libgfortran/io/transfer.c b/libgfortran/io/transfer.c
index 5dddcd31481c..48f6033465f8 100644
--- a/libgfortran/io/transfer.c
+++ b/libgfortran/io/transfer.c
@@ -166,7 +166,14 @@ read_sf (st_parameter_dt *dtp, int *length, int no_error)
{
readlen = *length;
q = salloc_r (dtp->u.p.current_unit->s, &readlen);
- memcpy (p, q, readlen);
+ if (readlen < *length)
+ {
+ generate_error (&dtp->common, LIBERROR_END, NULL);
+ return NULL;
+ }
+
+ if (q != NULL)
+ memcpy (p, q, readlen);
goto done;
}
--
GitLab