[flang] Fix heap overflow in Real formatting.

[Meinersbur]

Summary

The reinterpret_cast is problematic because 1. it violates the strict aliasing assumption and 2. the types can be of different size. In particular, BinaryFloatingPointNumber is always a power-of-2 whereas the source type can be smaller (like for 80-bit real). Therefore, when dereferencing the BinaryFloatingPointNumber, the accesses exceeds the source type's allocation size.

Fix by using memcpy to a zero-initialized buffer of the larger size.

Found using AddressSanitizer.

[klausler]

This works, but maybe the memcpy should be in a constructor for BinaryFloatingPointNumber -- it already has a memcpy in its default constructor, after an assertion that the size is not smaller (which would be removed).

[Meinersbur]

Copy integer part-wise instead of memcpy. memcpy/reinterpret_cast assumed platform endianess.

[klausler]

I think a better fix would be to generalize ToUInt64 as a template elsewhere. I'll prepare a patch and add you as the reviewer.

[Meinersbur]

Thanks, looking forward to you patch.

[klausler]

Please see https://reviews.llvm.org/D89435 for a proposed alternative patch.

[Meinersbur]

Superseded by D89435

flang/lib/Evaluate/real.cpp

llvm::raw_ostream &Real<W, P>::AsFortran(
   } else if (IsInfinite()) {
     if (IsNegative()) {
       o << "(-1._" << kind << "/0.)";
     } else {
       o << "(1._" << kind << "/0.)";
     }
   } else {
     using B = decimal::BinaryFloatingPointNumber<P>;
-    const auto *value{reinterpret_cast<const B *>(this)};
+    typename B::RawType b{0};
+    assert(sizeof b >= sizeof word_);
+    memcpy(&b, &word_, sizeof word_);
+    B value{b};
     char buffer[24000]; // accommodate real*16
     decimal::DecimalConversionFlags flags{}; // default: exact representation
     if (minimal) {
       flags = decimal::Minimize;
     }
     auto result{decimal::ConvertToDecimal<P>(buffer, sizeof buffer, flags,
-        static_cast<int>(sizeof buffer), decimal::RoundNearest, *value)};
+        static_cast<int>(sizeof buffer), decimal::RoundNearest, value)};
     const char *p{result.str};
     if (DEREF(p) == '-' || *p == '+') {
       o << *p++;
     }
     int expo{result.decimalExponent};
     if (*p != '0') {
       --expo;
     }