The patch below fixes a couple of invalid reads and writes.

The errors were all exposed by

  cd test

  make check AWK="valgrind --log-file=log ../gawk"

More specifically, the patch fixes the second and fourth of these

failures below.  The third seems to be due to a bug in the regex

source (I haven't tested updated versions from gnulib or glibc).

I don't know whether the first is valid or a false positive of valgrind,

but it appears both with and without optimization.

1)

==7543== My PID = 7543, parent PID = 7542.  Prog and args are:

==7543==    ../gawk

==7543==    -f

==7543==    fnarray.awk

==7543==

==7543== Invalid read of size 4

==7543==    at 0x40DBE9: yyparse (awkgram.y:797)

==7543==    by 0x42860B: main (main.c:565)

==7543==  Address 0x501D298 is 0 bytes inside a block of size 2 alloc'd

==7543==    at 0x4A19B15: malloc (vg_replace_malloc.c:207)

==7543==    by 0x40D1FE: yyparse (awkgram.y:2255)

==7543==    by 0x42860B: main (main.c:565)

2)

==9020==    ../gawk

==9020==    -f

==9020==    fieldwdth.awk

==9020==

==9020== Invalid write of size 4

==9020==    at 0x421783: set_FIELDWIDTHS (field.c:957)

==9020==    by 0x43A4BB: r_tree_eval (eval.c:1208)

==9020==    by 0x43BB79: interpret (eval.c:877)

==9020==    by 0x43BCD5: interpret (eval.c:456)

==9020==    by 0x428A8B: main (main.c:603)

==9020==  Address 0x501D0D8 is 0 bytes after a block of size 16 alloc'd

==9020==    at 0x4A19B15: malloc (vg_replace_malloc.c:207)

==9020==    by 0x421804: set_FIELDWIDTHS (field.c:921)

==9020==    by 0x43A4BB: r_tree_eval (eval.c:1208)

==9020==    by 0x43BB79: interpret (eval.c:877)

==9020==    by 0x43BCD5: interpret (eval.c:456)

==9020==    by 0x428A8B: main (main.c:603)

3)

==9124==    ../gawk

==9124==    -f

==9124==    ignrcase.awk

==9124==

==9124== Conditional jump or move depends on uninitialised value(s)

==9124==    at 0x430B88: re_compile_fastmap_iter (regcomp.c:356)

==9124==    by 0x430C9A: re_compile_fastmap (regcomp.c:304)

==9124==    by 0x435D2A: re_search_stub (regexec.c:419)

==9124==    by 0x436017: re_search (regexec.c:314)

==9124==    by 0x42B1B5: research (re.c:248)

==9124==    by 0x414938: sub_common (builtin.c:2242)

==9124==    by 0x43A26A: r_tree_eval (eval.c:991)

==9124==    by 0x43BB79: interpret (eval.c:877)

==9124==    by 0x43BE7F: interpret (eval.c:477)

==9124==    by 0x43BCD5: interpret (eval.c:456)

==9124==    by 0x4249D9: do_input (io.c:461)

==9124==    by 0x428AB2: main (main.c:607)

4)

==9212==    ../gawk

==9212==    --non-decimal-data

==9212==    -v

==9212==    a=0x1

==9212==    -f

==9212==    ../../gawk-stable/test/nondec2.awk

==9212==

==9212== Conditional jump or move depends on uninitialised value(s)

==9212==    at 0x4292AD: r_force_number (node.c:114)

==9212==    by 0x427AB7: arg_assign (main.c:1075)

==9212==    by 0x428635: main (main.c:524)

Cheers,

Ralf

2006-12-08  Ralf Wildenhues  <Ralf.Wildenhues@gmx.de>

        * field.c (set_FIELDWIDTHS): Avoid writing one past the end of

	the array.

	* node.c (r_force_number): Avoid reading uninitialized variable.

Index: field.c

===================================================================

RCS file: /cvsroot/gawk/gawk-stable/field.c,v

retrieving revision 1.2

diff -u -r1.2 field.c

--- field.c	11 Aug 2006 12:49:40 -0000	1.2

+++ field.c	6 Dec 2006 19:57:36 -0000

@@ -922,7 +922,7 @@

 	FIELDWIDTHS[0] = 0;

 	for (i = 1; ; i++) {

 		unsigned long int tmp;

-		if (i >= fw_alloc) {

+		if (i + 1 >= fw_alloc) {

 			fw_alloc *= 2;

 			erealloc(FIELDWIDTHS, int *, fw_alloc * sizeof(int), "set_FIELDWIDTHS");

 		}

Index: node.c

===================================================================

RCS file: /cvsroot/gawk/gawk-stable/node.c,v

retrieving revision 1.2

diff -u -r1.2 node.c

--- node.c	11 Aug 2006 12:49:40 -0000	1.2

+++ node.c	6 Dec 2006 19:57:37 -0000

@@ -96,6 +96,7 @@

 		if (! do_traditional && isnondecimal(cp, TRUE)) {

 			n->numbr = nondec2awknum(cp, cpend - cp);

 			n->flags |= NUMCUR;

+			ptr = cpend;

 			goto finish;

 		}

 	}

_______________________________________________

bug-gnu-utils@gnu.org

http://lists.gnu.org/mailman/listinfo/bug-gnu-utils