https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126610
--- Comment #2 from Arthur Chan <arthur.chan at adalogics dot com> --- Apologies. I had originally meant to include the extra root-cause tracing so as to support a clearer description. The issue was found by an Anthropic agent, and we verify it and rewrite the report manually from the original result we were given. Here is a summary of the issue. In libgfortran's list_read.c, the l_push_char function appends one character at a time to line_buffer, which it allocates once at the fixed SCRATCH_SIZE of 300 bytes and thereafter never grows or bounds-checks. The NaN branch of the read_real function then calls it for every character of a parenthesised NaN payload, stopping only at the closing parenthesis, end of input, or a separator, so the number of characters copied is decided by the input rather than by the size of the buffer. Untrusted data containing more than 300 characters can therefore overflow the buffer and cause an out-of-bounds write.
