The patch below fixes a couple of invalid reads and writes.
The errors were all exposed by
  cd test
  make check AWK="valgrind --log-file=log ../gawk"

More specifically, the patch fixes the second and fourth of these
failures below.  The third seems to be due to a bug in the regex
source (I haven't tested updated versions from gnulib or glibc).
I don't know whether the first is valid or a false positive of valgrind,
but it appears both with and without optimization.

1)
==7543== My PID = 7543, parent PID = 7542.  Prog and args are:
==7543==    ../gawk
==7543==    -f
==7543==    fnarray.awk
==7543==
==7543== Invalid read of size 4
==7543==    at 0x40DBE9: yyparse (awkgram.y:797)
==7543==    by 0x42860B: main (main.c:565)
==7543==  Address 0x501D298 is 0 bytes inside a block of size 2 alloc'd
==7543==    at 0x4A19B15: malloc (vg_replace_malloc.c:207)
==7543==    by 0x40D1FE: yyparse (awkgram.y:2255)
==7543==    by 0x42860B: main (main.c:565)

2)
==9020==    ../gawk
==9020==    -f
==9020==    fieldwdth.awk
==9020==
==9020== Invalid write of size 4
==9020==    at 0x421783: set_FIELDWIDTHS (field.c:957)
==9020==    by 0x43A4BB: r_tree_eval (eval.c:1208)
==9020==    by 0x43BB79: interpret (eval.c:877)
==9020==    by 0x43BCD5: interpret (eval.c:456)
==9020==    by 0x428A8B: main (main.c:603)
==9020==  Address 0x501D0D8 is 0 bytes after a block of size 16 alloc'd
==9020==    at 0x4A19B15: malloc (vg_replace_malloc.c:207)
==9020==    by 0x421804: set_FIELDWIDTHS (field.c:921)
==9020==    by 0x43A4BB: r_tree_eval (eval.c:1208)
==9020==    by 0x43BB79: interpret (eval.c:877)
==9020==    by 0x43BCD5: interpret (eval.c:456)
==9020==    by 0x428A8B: main (main.c:603)

3)
==9124==    ../gawk
==9124==    -f
==9124==    ignrcase.awk
==9124==
==9124== Conditional jump or move depends on uninitialised value(s)
==9124==    at 0x430B88: re_compile_fastmap_iter (regcomp.c:356)
==9124==    by 0x430C9A: re_compile_fastmap (regcomp.c:304)
==9124==    by 0x435D2A: re_search_stub (regexec.c:419)
==9124==    by 0x436017: re_search (regexec.c:314)
==9124==    by 0x42B1B5: research (re.c:248)
==9124==    by 0x414938: sub_common (builtin.c:2242)
==9124==    by 0x43A26A: r_tree_eval (eval.c:991)
==9124==    by 0x43BB79: interpret (eval.c:877)
==9124==    by 0x43BE7F: interpret (eval.c:477)
==9124==    by 0x43BCD5: interpret (eval.c:456)
==9124==    by 0x4249D9: do_input (io.c:461)
==9124==    by 0x428AB2: main (main.c:607)

4)
==9212==    ../gawk
==9212==    --non-decimal-data
==9212==    -v
==9212==    a=0x1
==9212==    -f
==9212==    ../../gawk-stable/test/nondec2.awk
==9212==
==9212== Conditional jump or move depends on uninitialised value(s)
==9212==    at 0x4292AD: r_force_number (node.c:114)
==9212==    by 0x427AB7: arg_assign (main.c:1075)
==9212==    by 0x428635: main (main.c:524)

Cheers,
Ralf

2006-12-08  Ralf Wildenhues  <Ralf.Wildenhues@gmx.de>

        * field.c (set_FIELDWIDTHS): Avoid writing one past the end of
	the array.
	* node.c (r_force_number): Avoid reading uninitialized variable.

Index: field.c
===================================================================
RCS file: /cvsroot/gawk/gawk-stable/field.c,v
retrieving revision 1.2
diff -u -r1.2 field.c
--- field.c	11 Aug 2006 12:49:40 -0000	1.2
+++ field.c	6 Dec 2006 19:57:36 -0000
@@ -922,7 +922,7 @@
 	FIELDWIDTHS[0] = 0;
 	for (i = 1; ; i++) {
 		unsigned long int tmp;
-		if (i >= fw_alloc) {
+		if (i + 1 >= fw_alloc) {
 			fw_alloc *= 2;
 			erealloc(FIELDWIDTHS, int *, fw_alloc * sizeof(int), "set_FIELDWIDTHS");
 		}
Index: node.c
===================================================================
RCS file: /cvsroot/gawk/gawk-stable/node.c,v
retrieving revision 1.2
diff -u -r1.2 node.c
--- node.c	11 Aug 2006 12:49:40 -0000	1.2
+++ node.c	6 Dec 2006 19:57:37 -0000
@@ -96,6 +96,7 @@
 		if (! do_traditional && isnondecimal(cp, TRUE)) {
 			n->numbr = nondec2awknum(cp, cpend - cp);
 			n->flags |= NUMCUR;
+			ptr = cpend;
 			goto finish;
 		}
 	}


_______________________________________________
bug-gnu-utils@gnu.org
http://lists.gnu.org/mailman/listinfo/bug-gnu-utils