Segfault in mpz_get_str for large numbers

[Dmitry Antipov]

Hello GMP developers,

 

It seems something goes wrong with `mpz_get_str' and _very_ _large_

numbers. The following example is 100% segfault on my system:

--

#include <stdio.h>
#include <stdlib.h>
#include <gmp.h>

 

void bug (unsigned long v)
{
  mpz_t x, y, p;
  char *str;
  int size;

 

  mpz_init (p);
  mpz_ui_pow_ui (p, 2UL, v);
  mpz_init_set_str (x, "38456785635834565837568537345", 10);
  mpz_init (y);
  mpz_mul (y, x, p);
  printf ("Result: %d-bytes number", (size = mpz_sizeinbase (y, 10) + 2));
  str = (char *) malloc (size);
  if (!str)
    abort ();
  /* Segfault in mpz_get_str */
  str = mpz_get_str (str, 10, y);
  printf (" (test ok for %lu)\n", v);
  free (str);
}

 

int main (void)
{
  setbuf (stdout, NULL);
  bug (3UL);
  bug (45UL);
  bug (345UL);
  bug (7834UL);
  bug (24533UL);
  bug (746396UL);
  bug (8343454UL);
  bug (73453455UL);
  bug (663896741UL);
  bug (3498674875UL);
  return 0;
}

--

Segfault entered in `mpz_get_str' called from `bug (73453455UL)'
(the system has _much_ _more_ memory than required for result):

--

Result: 32-bytes number (test ok for 3)
Result: 45-bytes number (test ok for 45)
Result: 135-bytes number (test ok for 345)
Result: 2389-bytes number (test ok for 7834)
Result: 7416-bytes number (test ok for 24533)
Result: 224719-bytes number (test ok for 746396)
Result: 2511661-bytes number (test ok for 8343454)
Result: 22111724-bytes numberSegmentation fault (core dumped)

--

Gdb backtrace below (GMP is statically linked):

--

GNU gdb 5.1.1
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...
Core was generated by `./gmpbug'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/i686/libc.so.6...done.
Loaded symbols for /lib/i686/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  __gmpz_get_str (res_str=0x41785008 "", base=10, x=0xbf73df40)
    at get_str.c:79
79       MPN_COPY (xp, x->_mp_d, x_size);
(gdb) bt
#0  __gmpz_get_str (res_str=0x41785008 "", base=10, x=0xbf73df40)
    at get_str.c:79
#1  0x08048619 in bug ()
#2  0x080486a2 in main ()
#3  0x40047507 in __libc_start_main (main=0x8048632 <main>, argc=1,
    ubp_av=0xbffffa64, init=0x8048374 <_init>, fini=0x8051510 <_fini>,
    rtld_fini=0x4000dc14 <_dl_fini>, stack_end=0xbffffa5c)
    at ../sysdeps/generic/libc-start.c:129

--

My stuff is AMD Duron CPU (`athlon-pc-linux-gnu', as recognized by GMP's

`configure') Linux RH7.2 with 2.4.18 kernel. GMP version 4.1 and
test program above are compiled with GCC 3.1 with `-O2 -g'. GMP is

configured with `./configure --enable-cxx --enable-mpbsd'.

 

Thanks,
Dmitry Antipov <address@hidden>