found an overlapping data buffer in file natGCInfo.cc

Mon Jul 27 14:43:00 GMT 2009

Andrew Haley wrote:
> On 07/27/2009 10:29 AM, Martin Ettl wrote:
>> Hello,
>>>> while checking the sources of gcc-4.4.1 with the static code analysis tool cppcheck i found an overlapping data buffer in file gcc-4.4.1/libjava/gnu/gcj/natGCInfo.cc at line 410. 
>>>> Take a look at the file:
>>>> static void *
>> nomem_handler(size_t size)
>> {
>> if (oomDumpName)
>> {
>> char temp[strlen(oomDumpName) + 20];
>> 410 sprintf(temp, "%s%03d", temp, GC_dump_count++);

The second instance of temp should be oomDumpName.
>> printf("nomem_handler(%zd) called\n", size);
>> gc_ok--;
>> GC_enumerator x(temp);
>> x.enumerate();
>> gc_ok++;
>> }
>> return (void*)0;
>> }
>>>> Indeed, the buffer overlapps. This can lead to segmentation faults!
>> Thanks. How very weird; I wonder what that code was supposed to do.
>
Someone should fix it. If nobody does soon, I suppose I will as I added 
it in the first place.
David Daney