From a61efd469371b71483d42afa1038e6a8c16baf4a Mon Sep 17 00:00:00 2001
From: Harald Anlauf <anlauf@gmx.de>
Date: Mon, 25 Jan 2021 21:33:53 +0100
Subject: [PATCH] PR fortran/70070 - ICE on initializing character data beyond
 min/max bound

Check for initialization of substrings beyond bounds in DATA statements.

gcc/fortran/ChangeLog:

	PR fortran/70070
	* data.c (create_character_initializer): Check substring indices
	against bounds.
	(gfc_assign_data_value): Catch error returned from
	create_character_initializer.

gcc/testsuite/ChangeLog:

	PR fortran/70070
	* gfortran.dg/pr70070.f90: New test.
---
 gcc/fortran/data.c                    | 15 +++++++++++++++
 gcc/testsuite/gfortran.dg/pr70070.f90 |  8 ++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 gcc/testsuite/gfortran.dg/pr70070.f90

diff --git a/gcc/fortran/data.c b/gcc/fortran/data.c
index 1313b335c86..13e3506dd1e 100644
--- a/gcc/fortran/data.c
+++ b/gcc/fortran/data.c
@@ -183,6 +183,19 @@ create_character_initializer (gfc_expr *init, gfc_typespec *ts,
 	}
     }
 
+  if (start < 0)
+    {
+      gfc_error ("Substring start index at %L is less than one",
+		 &ref->u.ss.start->where);
+      return NULL;
+    }
+  if (end > init->value.character.length)
+    {
+      gfc_error ("Substring end index at %L exceeds the string length",
+		 &ref->u.ss.end->where);
+      return NULL;
+    }
+
   if (rvalue->ts.type == BT_HOLLERITH)
     {
       for (size_t i = 0; i < (size_t) len; i++)
@@ -576,6 +589,8 @@ gfc_assign_data_value (gfc_expr *lvalue, gfc_expr *rvalue, mpz_t index,
       if (lvalue->ts.u.cl->length == NULL && !(ref && ref->u.ss.length != NULL))
 	return false;
       expr = create_character_initializer (init, last_ts, ref, rvalue);
+      if (!expr)
+	return false;
     }
   else
     {
diff --git a/gcc/testsuite/gfortran.dg/pr70070.f90 b/gcc/testsuite/gfortran.dg/pr70070.f90
new file mode 100644
index 00000000000..04a6dd585ab
--- /dev/null
+++ b/gcc/testsuite/gfortran.dg/pr70070.f90
@@ -0,0 +1,8 @@
+! { dg-do compile }
+! PR fortran/70070 - ICE on initializing character data beyond min/max bound
+
+program p
+  character(1) :: a, b
+  data (a(i:i),i=0,0) /1*'#'/   ! { dg-error "Substring start index" }
+  data (b(i:i),i=2,3) /2*'#'/   ! { dg-error "Substring end index" }
+end
-- 
2.30.2