#13731: Fix libsingular memory management
---------------------------+------------------------------------------------
       Reporter:  nbruin   |         Owner:  rlm     
           Type:  defect   |        Status:  new     
       Priority:  major    |     Milestone:  sage-5.6
      Component:  memleak  |    Resolution:          
       Keywords:           |   Work issues:          
Report Upstream:  N/A      |     Reviewers:          
        Authors:           |     Merged in:          
   Dependencies:           |      Stopgaps:          
---------------------------+------------------------------------------------

Comment (by nbruin):

 > It's not immediately clear to me that `ExpSize/sizeof(long)` really is
 (at most) `rN+1` (see `p_MemAdd.h` for the definition).

 In fact, it certainly is not:
 {{{
 int
 ExpSize=(((rN+1)*sizeof(int)+sizeof(long)-1)/sizeof(long))*sizeof(long);
 }}}
 so `ExpSize` gets rounded ''up''. If `sizeof(int)=4` and `sizeof(long)=8`
 then for `rN=2` we get `(rN+1)*sizeof(int)=12` and `ExpSize=16` (which, by
 the valgrind report, is probably exactly the case we're in). So
 `p_MemAdd_LengthGeneral` is definitely writing out of bounds. I think this
 code should simply read:
 {{{
   int *F=(int *)omAlloc0(ExpSize);
   int *G=(int *)omAlloc0(ExpSize);

   memcpy(F, F0,ExpSize);
   // pExpVectorCopy(F,F0);
   memcpy(G, G0,ExpSize);
 }}}
 God knows why they add an array of int as an array of long in
 {{{
 p_MemAdd_LengthGeneral(F, G, ExpSize/sizeof(long));
 }}}
 Are they sure there's no carry (I guess, if these are non-negative signed
 ints the sign bit would buffer any carry).

 Is it viable to simply ditch Singular :-?

 By the way, since most architectures with `sizeof(long)=8` would be 8-byte
 aligned anyway, I doubt that this error would ever lead to real trouble.
 But the sloppiness surely is worrying.

-- 
Ticket URL: <http://trac.sagemath.org/sage_trac/ticket/13731#comment:31>
Sage <http://www.sagemath.org>
Sage: Creating a Viable Open Source Alternative to Magma, Maple, Mathematica, 
and MATLAB

-- 
You received this message because you are subscribed to the Google Groups 
"sage-trac" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to 
[email protected].
For more options, visit this group at 
http://groups.google.com/group/sage-trac?hl=en.

Reply via email to