Dear all, here's another simple patch for a subtle array bounds violation in the checking of argument labels for the MIN/MAX intrinsics. Found by David Binderman with a UBSAN instrumented compiler. The fix was confirmed by him in the PR.
Pushed as r16-8309-gb2b3db8f83a374 . Thanks, Harald
From b2b3db8f83a37492429327b5228ee1c7f20a13f7 Mon Sep 17 00:00:00 2001 From: Harald Anlauf <[email protected]> Date: Fri, 27 Mar 2026 20:51:20 +0100 Subject: [PATCH] Fortran: fix array bounds violation in min_max_args [PR124656] PR fortran/124656 gcc/fortran/ChangeLog: * check.cc (min_max_args): Fix array index used for registering labeled arguments of the MIN/MAX intrinsics for subsequent duplicate label checks. --- gcc/fortran/check.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gcc/fortran/check.cc b/gcc/fortran/check.cc index 29d9f07b81d..c4d9901a82d 100644 --- a/gcc/fortran/check.cc +++ b/gcc/fortran/check.cc @@ -4082,7 +4082,7 @@ min_max_args (gfc_actual_arglist *args) /* Note: Having a keywordless argument after an "arg=" is checked before. */ nlabelless = 0; nlabels = XALLOCAVEC (int, nargs); - for (arg = args, i = 0; arg; arg = arg->next, i++) + for (arg = args, i = 0; arg; arg = arg->next) if (arg->name) { int n; @@ -4098,6 +4098,7 @@ min_max_args (gfc_actual_arglist *args) if (n <= nlabelless) goto duplicate; nlabels[i] = n; + i++; if (n == 1) a1 = true; if (n == 2) -- 2.51.0
