https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95998
--- Comment #3 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
> If we ever have three occurences of gfc_typename in a function list,
> like
>
> foo (gfc_typename(a), gfc_typename(b), gfc_typename(c));
>
> we will get the wrong result for the third one. We will also get
> a wrong result for
>
> pa = gfc_typename(a);
> pb = gfc_typename(b);
> pc = gfc_typename(c);
>
> because then pa will point to the same memory as pc.
OK. I think I am now starting to understand how this proc works.
I have looked at the occurrences of gfc_typename, and AFAICT they appear only
once or twice within
the same gfc_error, except for (line 2303 in check.c)
gfc_error ("The function passed as OPERATOR at %L has arguments of type "
"%s and %s but shall have type %s", &op->where,
gfc_typename (&formal->sym->ts),
gfc_typename (&formal->next->sym->ts), gfc_typename (a));
but 'a' is a gfc_expr, while 'formal->sym->ts', and 'formal->next->sym->ts' are
gfc_typespec, so different procs and it should be OK.
Note that presently gfc_typename is only called in error messages and potential
problems will
only show as strange errors.
However in noticed a potential buffer overflow with DEC extensions:
static char buffer1[GFC_MAX_SYMBOL_LEN + 7]; /* 7 for "TYPE()" + '\0'. */
static char buffer2[GFC_MAX_SYMBOL_LEN + 7];
should be
static char buffer1[GFC_MAX_SYMBOL_LEN + 8]; /* 8 for "UNION()" + '\0'. */
static char buffer2[GFC_MAX_SYMBOL_LEN + 8];
