Messages in this thread | | | From | Yiyuan guo <> | Date | Fri, 21 May 2021 15:55:03 +0800 | Subject | Re: A divide by zero bug in lib/math/rational.c (with triggering input) |
| |
Thanks for your timely response.
I am not familiar with the theorem. But any input satisfying the condition below will trigger a divide by zero at the first loop iteration:
(given_numerator / given_denominator > max_numerator) || (1 + given_numerator / given_denominator > max_denominator)
I think such a condition is rather complex and may not be enforced by all callers of this function.
On Fri, May 21, 2021 at 3:42 PM Andy Shevchenko <andy.shevchenko@gmail.com> wrote: > > > > On Friday, May 21, 2021, Andy Shevchenko <andy.shevchenko@gmail.com> wrote: >> >> >> >> On Friday, May 21, 2021, Yiyuan guo <yguoaz@gmail.com> wrote: >>> >>> In the file lib/math/rational.c, the function >>> rational_best_approximation has the following >>> code: >>> >>> void rational_best_approximation( >>> unsigned long given_numerator, unsigned long given_denominator, >>> unsigned long max_numerator, unsigned long max_denominator, >>> unsigned long *best_numerator, unsigned long *best_denominator) { >>> ... >>> if ((n2 > max_numerator) || (d2 > max_denominator)) { >>> unsigned long t = min((max_numerator - n0) / n1, >>> (max_denominator - d0) / d1); >>> ... >>> } >>> >>> d1 may be equal to zero when performing the division, leading to a >>> divide by zero problem. >>> >>> One input to trigger the divide by zero bug is: >>> rational_best_approximation(31415, 100, (1 << 8) - 1, (1 << 5) - 1, &n, &d) >> >> >> >> Have you read a theorem about this? TL;DR; as far as I can see the input data is not suitable for this function. >> > > > I think we may add the proper check and saturate the output which in your case should be (255,1). > >> >> >> -- >> With Best Regards, >> Andy Shevchenko >> >> > > > -- > With Best Regards, > Andy Shevchenko > >
| |