Fortran: Fix heap-use-after-free

This fix stops freeing the current BLOCK namespace during malformed
END error recovery.  It now lets normal block unwinding/cleanup handle
the free, preventing the heap-use-after-free.

Suggested-by: Jakub Jelinek <jakub@redhat.com>
Signed-off-by: Christopher Albert <albert@tugraz.at>
	PR fortran/122491

gcc/fortran/ChangeLog:

	* decl.cc (gfc_match_end): Do not free current BLOCK namespace
	during malformed END cleanup.

diff --git a/gcc/fortran/decl.cc b/gcc/fortran/decl.cc
index cb6bd6f8cc05eb2b8c6b8df2026e844d15ead34a..b5128580548401bfdbe3767361166065c863bb6e 100644 (file)
--- a/gcc/fortran/decl.cc
+++ b/gcc/fortran/decl.cc
@@ -9267,7 +9267,8 @@ cleanup:
          ns = ns->sibling;
        }
 
-      gfc_free_namespace (gfc_current_ns);
+      /* The namespace can still be referenced by parser state and code nodes;
+        let normal block unwinding/freeing own its lifetime.  */
       gfc_current_ns = parent_ns;
       gfc_state_stack = gfc_state_stack->previous;
       state = gfc_current_state ();