transfer.c (read_sf): Check if readlen was less than the requested number of bytes...

2007-12-25  Jerry DeLisle  <jvdelisle@gcc.gnu.org>

	* io/transfer.c (read_sf): Check if readlen was less than the requested
	number of bytes to read and if so, generate error.

From-SVN: r131177

diff --git a/libgfortran/ChangeLog b/libgfortran/ChangeLog
index 0db6850733c57be4a14ff756e3f1de59667f5e45..b4f77b77e217c525425857d377a6aa1033393a30 100644 (file)
--- a/libgfortran/ChangeLog
+++ b/libgfortran/ChangeLog
@@ -1,3 +1,8 @@
+2007-12-25  Jerry DeLisle  <jvdelisle@gcc.gnu.org>
+
+       * io/transfer.c (read_sf): Check if readlen was less than the requested
+       number of bytes to read and if so, generate error.
+
 2007-12-25  Daniel Franke  <franke.daniel@gmail.com>
 
        PR fortran/34533

diff --git a/libgfortran/io/transfer.c b/libgfortran/io/transfer.c
index 5dddcd31481c28d984a5462761b23bd80bbacf25..48f6033465f8f9d1c51cb8d4f330a0c406ae6846 100644 (file)
--- a/libgfortran/io/transfer.c
+++ b/libgfortran/io/transfer.c
@@ -166,7 +166,14 @@ read_sf (st_parameter_dt *dtp, int *length, int no_error)
     {
       readlen = *length;
       q = salloc_r (dtp->u.p.current_unit->s, &readlen);
-      memcpy (p, q, readlen);
+      if (readlen < *length)
+       {
+         generate_error (&dtp->common, LIBERROR_END, NULL);
+         return NULL;
+       }
+       
+      if (q != NULL)
+        memcpy (p, q, readlen);
       goto done;
     }