#11771: sage crashes on some degenerate flint xgcd's
--------------------------------+-------------------------------------------
   Reporter:  lftabera          |          Owner:  AlexGhitza                  
       Type:  defect            |         Status:  new                         
   Priority:  critical          |      Milestone:  sage-4.7.2                  
  Component:  basic arithmetic  |       Keywords:  flint, crash, xgcd fmpq_poly
Work_issues:                    |       Upstream:  N/A                         
   Reviewer:                    |         Author:                              
     Merged:                    |   Dependencies:                              
--------------------------------+-------------------------------------------

Comment(by leif):

 Apparently a proper fix ''to the insufficient size of `temp`'' is:
 {{{
 #!diff
 diff --git a/sage/libs/flint/fmpq_poly.c b/sage/libs/flint/fmpq_poly.c
 --- a/sage/libs/flint/fmpq_poly.c
 +++ b/sage/libs/flint/fmpq_poly.c
 @@ -2360,15 +2360,14 @@
      /*   rop->den rop->num ==
 */
      /*             (s->num a->den / s->den) a +  (t->num b->den / t->den)
 b. */

 -    limbs = FLINT_MAX(s->num->limbs, t->num->limbs);
 -    limbs = FLINT_MAX(limbs, fmpz_size(s->den));
 -    limbs = FLINT_MAX(limbs, fmpz_size(t->den) + fmpz_size(rop->den) +
 fmpz_size(lead));
 -    temp = fmpz_init(limbs);
 -
      s->den = fmpz_realloc(s->den, fmpz_size(s->den) + fmpz_size(rop->den)
                                                      + fmpz_size(lead));
      if (!fmpz_is_one(a->den))
          fmpz_poly_scalar_mul_fmpz(s->num, s->num, a->den);
 +
 +    limbs = fmpz_size(s->den) + fmpz_size(rop->den);
 +    temp = fmpz_init(limbs);
 +
      fmpz_mul(temp, s->den, rop->den);
      fmpz_mul(s->den, temp, lead);

 @@ -2376,6 +2375,10 @@
                                                      + fmpz_size(lead));
      if (!fmpz_is_one(b->den))
          fmpz_poly_scalar_mul_fmpz(t->num, t->num, b->den);
 +
 +    limbs = fmpz_size(t->den) + fmpz_size(rop->den);
 +    temp = fmpz_realloc(temp, limbs);
 +
      fmpz_mul(temp, t->den, rop->den);
      fmpz_mul(t->den, temp, lead);

 }}}

 But someone more knowledgeable than me should IMHO (re-)review ''the whole
 function'' w.r.t. the sizes used in memory (re)allocations.

 Reluctantly I dispense with cc-ing all the reviewers of #4000... ;-)

-- 
Ticket URL: <http://trac.sagemath.org/sage_trac/ticket/11771#comment:18>
Sage <http://www.sagemath.org>
Sage: Creating a Viable Open Source Alternative to Magma, Maple, Mathematica, 
and MATLAB

-- 
You received this message because you are subscribed to the Google Groups 
"sage-trac" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to 
[email protected].
For more options, visit this group at 
http://groups.google.com/group/sage-trac?hl=en.

Reply via email to