[Bug libfortran/126610] A correct list-directed READ of a NaN(...) value overflows libgfortran's fixed 300-byte scratch buffer, because the runtime alone chooses and mis-manages the buffer size

[arthur.chan at adalogics dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126610

--- Comment #4 from Arthur Chan <arthur.chan at adalogics dot com> ---
Yes. Assume gfortran and valgrind is already installed.

Store this code as bug.f90

```
real :: x
read(*,*) x
end
```

And then compile and run it with gfortran with malicious input. This will cause
corrupted top size and crash with SIGABRT from the buffer overflow.

```
gfortran bug.f90 -o bug
perl -e 'print "NaN(", "a" x 400, ")\n"' | ./bug
```

If we run the compiled fortran program with valgrind, we can see the buffer
overflow stacktrace.

```
perl -e 'print "NaN(", "a" x 400, ")\n"' | valgrind -q ./bug
```