#9826: Memory corruption in polynomial complex_roots() method
----------------------------------------------+-----------------------------
Reporter: hlaw | Owner: somebody
Type: defect | Status: needs_review
Priority: major | Milestone: sage-5.0
Component: commutative algebra | Keywords: complex root,
polynomial, finite field
Work_issues: | Upstream: N/A
Reviewer: Michael Orlitzky, Johan Bosman | Author: Johan Bosman,
Michael Orlitzky
Merged: | Dependencies:
----------------------------------------------+-----------------------------
Changes (by johanbosman):
* reviewer: => Michael Orlitzky, Johan Bosman
Old description:
> Obviously the following code should raise an error (which is correctly
> given at the end), but it shouldn't be trying to `free()` non-aligned
> pointers.
> {{{
> sage: k.<a> = GF(7^3)
> sage: P.<x> = PolynomialRing(k)
> sage: P.random_element().complex_roots()
> python(29941) malloc: *** error for object 0x5a45c: Non-aligned pointer
> being freed
> *** set a breakpoint in malloc_error_break to debug
> python(29941) malloc: *** error for object 0x2fffc: Non-aligned pointer
> being freed
> *** set a breakpoint in malloc_error_break to debug
> ---------------------------------------------------------------------------
> TypeError Traceback (most recent call
> last)
>
> /Users/hlaw/<ipython console> in <module>()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/rings/polynomial/polynomial_element.so in
> sage.rings.polynomial.polynomial_element.Polynomial.complex_roots
> (sage/rings/polynomial/polynomial_element.c:32235)()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/rings/polynomial/polynomial_element.so in
> sage.rings.polynomial.polynomial_element.Polynomial.roots
> (sage/rings/polynomial/polynomial_element.c:31226)()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/rings/polynomial/polynomial_element.so in
> sage.rings.polynomial.polynomial_element.Polynomial.change_ring
> (sage/rings/polynomial/polynomial_element.c:16456)()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/structure/parent.so in
> sage.structure.parent.Parent.__call__ (sage/structure/parent.c:6407)()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/structure/coerce_maps.so in
> sage.structure.coerce_maps.DefaultConvertMap_unique._call_
> (sage/structure/coerce_maps.c:3108)()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/structure/coerce_maps.so in
> sage.structure.coerce_maps.DefaultConvertMap_unique._call_
> (sage/structure/coerce_maps.c:3010)()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/rings/polynomial/polynomial_ring.pyc in
> _element_constructor_(self, x, check, is_gen, construct, **kwds)
> 311 x = x.Polrev()
> 312
> --> 313 return C(self, x, check, is_gen, construct=construct,
> **kwds)
> 314
> 315 def is_integral_domain(self, proof = True):
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/rings/polynomial/polynomial_real_mpfr_dense.so in
> sage.rings.polynomial.polynomial_real_mpfr_dense.PolynomialRealDense.__init__
> (sage/rings/polynomial/polynomial_real_mpfr_dense.c:3609)()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/structure/parent.so in
> sage.structure.parent.Parent.__call__ (sage/structure/parent.c:6407)()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/structure/coerce_maps.so in
> sage.structure.coerce_maps.DefaultConvertMap_unique._call_
> (sage/structure/coerce_maps.c:3108)()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/structure/coerce_maps.so in
> sage.structure.coerce_maps.DefaultConvertMap_unique._call_
> (sage/structure/coerce_maps.c:3010)()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/rings/real_mpfr.so in
> sage.rings.real_mpfr.RealField_class._element_constructor_
> (sage/rings/real_mpfr.c:5058)()
>
> /Users/hlaw/src/sage-src/local/lib/python2.6/site-
> packages/sage/rings/real_mpfr.so in sage.rings.real_mpfr.RealNumber._set
> (sage/rings/real_mpfr.c:8767)()
>
> TypeError: Unable to convert x (='2*a^2+6*a+6') to real number.
> }}}
> If you run the code `P.random_element().complex_roots()` a few more
> times, you get a segfault:
> {{{
> sage: P.random_element().complex_roots()
>
> ------------------------------------------------------------
> Unhandled SIGSEGV: A segmentation fault occurred in Sage.
> This probably occurred because a *compiled* component
> of Sage has a bug in it (typically accessing invalid memory)
> or is not properly wrapped with _sig_on, _sig_off.
> You might want to run Sage under gdb with 'sage -gdb' to debug this.
> Sage will now terminate (sorry).
> ------------------------------------------------------------
> }}}
> Environment: Sage 4.5.2 on Mac OS X 10.5.8 (32 bit).
New description:
Obviously the following code should raise an error (which is correctly
given at the end), but it shouldn't be trying to `free()` non-aligned
pointers.
{{{
sage: k.<a> = GF(7^3)
sage: P.<x> = PolynomialRing(k)
sage: P.random_element().complex_roots()
python(29941) malloc: *** error for object 0x5a45c: Non-aligned pointer
being freed
*** set a breakpoint in malloc_error_break to debug
python(29941) malloc: *** error for object 0x2fffc: Non-aligned pointer
being freed
*** set a breakpoint in malloc_error_break to debug
---------------------------------------------------------------------------
TypeError Traceback (most recent call
last)
/Users/hlaw/<ipython console> in <module>()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/rings/polynomial/polynomial_element.so in
sage.rings.polynomial.polynomial_element.Polynomial.complex_roots
(sage/rings/polynomial/polynomial_element.c:32235)()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/rings/polynomial/polynomial_element.so in
sage.rings.polynomial.polynomial_element.Polynomial.roots
(sage/rings/polynomial/polynomial_element.c:31226)()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/rings/polynomial/polynomial_element.so in
sage.rings.polynomial.polynomial_element.Polynomial.change_ring
(sage/rings/polynomial/polynomial_element.c:16456)()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/structure/parent.so in sage.structure.parent.Parent.__call__
(sage/structure/parent.c:6407)()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/structure/coerce_maps.so in
sage.structure.coerce_maps.DefaultConvertMap_unique._call_
(sage/structure/coerce_maps.c:3108)()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/structure/coerce_maps.so in
sage.structure.coerce_maps.DefaultConvertMap_unique._call_
(sage/structure/coerce_maps.c:3010)()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/rings/polynomial/polynomial_ring.pyc in
_element_constructor_(self, x, check, is_gen, construct, **kwds)
311 x = x.Polrev()
312
--> 313 return C(self, x, check, is_gen, construct=construct,
**kwds)
314
315 def is_integral_domain(self, proof = True):
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/rings/polynomial/polynomial_real_mpfr_dense.so in
sage.rings.polynomial.polynomial_real_mpfr_dense.PolynomialRealDense.__init__
(sage/rings/polynomial/polynomial_real_mpfr_dense.c:3609)()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/structure/parent.so in sage.structure.parent.Parent.__call__
(sage/structure/parent.c:6407)()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/structure/coerce_maps.so in
sage.structure.coerce_maps.DefaultConvertMap_unique._call_
(sage/structure/coerce_maps.c:3108)()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/structure/coerce_maps.so in
sage.structure.coerce_maps.DefaultConvertMap_unique._call_
(sage/structure/coerce_maps.c:3010)()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/rings/real_mpfr.so in
sage.rings.real_mpfr.RealField_class._element_constructor_
(sage/rings/real_mpfr.c:5058)()
/Users/hlaw/src/sage-src/local/lib/python2.6/site-
packages/sage/rings/real_mpfr.so in sage.rings.real_mpfr.RealNumber._set
(sage/rings/real_mpfr.c:8767)()
TypeError: Unable to convert x (='2*a^2+6*a+6') to real number.
}}}
If you run the code `P.random_element().complex_roots()` a few more times,
you get a segfault:
{{{
sage: P.random_element().complex_roots()
------------------------------------------------------------
Unhandled SIGSEGV: A segmentation fault occurred in Sage.
This probably occurred because a *compiled* component
of Sage has a bug in it (typically accessing invalid memory)
or is not properly wrapped with _sig_on, _sig_off.
You might want to run Sage under gdb with 'sage -gdb' to debug this.
Sage will now terminate (sorry).
------------------------------------------------------------
}}}
Environment: Sage 4.5.2 on Mac OS X 10.5.8 (32 bit).
Apply [attachment:sage-trac_9826.patch] to the sage repository.
--
Comment:
In sage-5.0.beta4 this all works fine, so if you're okay with this, I
suggest we give this ticket a positive review.
--
Ticket URL: <http://trac.sagemath.org/sage_trac/ticket/9826#comment:5>
Sage <http://www.sagemath.org>
Sage: Creating a Viable Open Source Alternative to Magma, Maple, Mathematica,
and MATLAB
--
You received this message because you are subscribed to the Google Groups
"sage-trac" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/sage-trac?hl=en.
