Skip to content

Reject zero exponent in mp_root_n#600

Open
MagicalTux wants to merge 1 commit into
libtom:developfrom
MagicalTux:fix-root_n-div-by-zero
Open

Reject zero exponent in mp_root_n#600
MagicalTux wants to merge 1 commit into
libtom:developfrom
MagicalTux:fix-root_n-div-by-zero

Conversation

@MagicalTux

Copy link
Copy Markdown
Contributor

mp_root_n(a, b, c) validates b < 0 but not b == 0. A zero exponent passes the input check and reaches ilog2 = ilog2 / b, a division by zero.

The early-exit branches (b > INT_MAX/2 and ilog2 < b) are both false when b == 0 and a has at least one bit, so control always reaches the divide.

Effect is platform dependent: SIGFPE (process abort / DoS) on x86/x86-64, silently returns a wrong result on architectures where integer divide-by-zero does not trap. It is undefined behavior on all platforms.

Fix: change the bound to b < 1 so a zero exponent returns MP_VAL.

Confirmed with UndefinedBehaviorSanitizer:

mp_root_n.c:60:19: runtime error: division by zero

Reproducer: mp_set_u32(&a, 123456789); mp_root_n(&a, 0, &c);

A b of 0 passed the input check and reached the ilog2 / b division,
causing a division by zero.
@czurnieden

Copy link
Copy Markdown
Contributor

This and some other little bugs (e.g.: perfect powers get ignored) have been fixed in #599 which has not been merged (yet?). But nevertheless: thanks a lot!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants