From 204ebe6a38fdefbf6075ab99c6f768c123b64313 Mon Sep 17 00:00:00 2001 From: jvdelisle Date: Fri, 27 Oct 2017 18:51:35 +0000 Subject: 2017-10-27 Jerry DeLisle Rimvydas (RJ) Backport from trunk PR libgfortran/81938 io/format.c (free_format_data): Don't try to free vlist descriptors past the end of the fnode array. git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-7-branch@254169 138bc75d-0d04-0410-961f-82ee72b054a4 --- libgfortran/ChangeLog | 8 ++++++++ libgfortran/io/format.c | 3 ++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/libgfortran/ChangeLog b/libgfortran/ChangeLog index 20f3ebdc6a6..3a359e5059a 100644 --- a/libgfortran/ChangeLog +++ b/libgfortran/ChangeLog @@ -1,3 +1,11 @@ +2017-10-27 Jerry DeLisle + Rimvydas (RJ) + + Backport from trunk + PR libgfortran/81938 + io/format.c (free_format_data): Don't try to free vlist + descriptors past the end of the fnode array. + 2017-10-19 Thomas Koenig Backport from trunk diff --git a/libgfortran/io/format.c b/libgfortran/io/format.c index bd14ac37bb3..c2abdd7b3af 100644 --- a/libgfortran/io/format.c +++ b/libgfortran/io/format.c @@ -266,7 +266,8 @@ free_format_data (format_data *fmt) return; /* Free vlist descriptors in the fnode_array if one was allocated. */ - for (fnp = fmt->array.array; fnp->format != FMT_NONE; fnp++) + for (fnp = fmt->array.array; fnp < &fmt->array.array[FARRAY_SIZE] && + fnp->format != FMT_NONE; fnp++) if (fnp->format == FMT_DT) { if (GFC_DESCRIPTOR_DATA(fnp->u.udf.vlist)) -- cgit v1.2.1