[flang] Fix heap overflow in Real formatting.

[Meinersbur]

Summary

The reinterpret_cast is problematic because 1. it violates the strict aliasing assumption and 2. the types can be of different size. In particular, BinaryFloatingPointNumber is always a power-of-2 whereas the source type can be smaller (like for 80-bit real). Therefore, when dereferencing the BinaryFloatingPointNumber, the accesses exceeds the source type's allocation size.

Fix by using memcpy to a zero-initialized buffer of the larger size.

Found using AddressSanitizer.

[klausler]

This works, but maybe the memcpy should be in a constructor for BinaryFloatingPointNumber -- it already has a memcpy in its default constructor, after an assertion that the size is not smaller (which would be removed).

[Meinersbur]

Copy integer part-wise instead of memcpy. memcpy/reinterpret_cast assumed platform endianess.

[klausler]

I think a better fix would be to generalize ToUInt64 as a template elsewhere. I'll prepare a patch and add you as the reviewer.

[Meinersbur]

Thanks, looking forward to you patch.

[klausler]

Please see https://reviews.llvm.org/D89435 for a proposed alternative patch.

[Meinersbur]

Superseded by D89435

flang/lib/Evaluate/real.cpp

llvm::raw_ostream &Real<W, P>::AsFortran(
   } else if (IsInfinite()) {
     if (IsNegative()) {
       o << "(-1._" << kind << "/0.)";
     } else {
       o << "(1._" << kind << "/0.)";
     }
   } else {
     using B = decimal::BinaryFloatingPointNumber<P>;
-    const auto *value{reinterpret_cast<const B *>(this)};
+    constexpr static const auto bits{word_.bits};
+    typename B::RawType b = word_.ToUInt64();
+    if constexpr (bits > 64) {
+      auto d{word_};
+      for (int i{64}; i < bits; i += 64) {
+        d = d.SHIFTR(64);
+        const typename B::RawType l{d.ToUInt64()};
+        b |= (l << i);
+      }
+    }
+    B value{b};
+
     char buffer[24000]; // accommodate real*16
     decimal::DecimalConversionFlags flags{}; // default: exact representation
     if (minimal) {
       flags = decimal::Minimize;
     }
     auto result{decimal::ConvertToDecimal<P>(buffer, sizeof buffer, flags,
-        static_cast<int>(sizeof buffer), decimal::RoundNearest, *value)};
+        static_cast<int>(sizeof buffer), decimal::RoundNearest, value)};
     const char *p{result.str};
     if (DEREF(p) == '-' || *p == '+') {
       o << *p++;
     }
     int expo{result.decimalExponent};
     if (*p != '0') {
       --expo;
     }