bugGNU Scientific Library - Bugs: bug #66026, gsl_linalg_LU_decomp using...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #66026: gsl_linalg_LU_decomp using uninitialized memory

Submitter:  Andrew Davison <infradig>
Submitted:  Fri 26 Jul 2024 02:56:44 AM UTC
   
 
Category:  Runtime error Severity:  3 - Normal
Operating System:  Ubuntu Status:  None
Assigned to:  None Open/Closed:  Open
Release:  2.8

Fri 27 Dec 2024 12:07:28 PM UTC, comment #4: 

Attached is a patch that fixes the subtle bug discovered here. I've implemented the suggested change (executing the mentioned for-loop only when the status == 0) in both lu.c and luc.c.

(file #56718)

Christian Krueger <mangrove84>
Mon 29 Jul 2024 09:36:06 AM UTC, comment #3: 

Here's what my user who found this problem, says:

fyi
More info for if those gsl guys start a discussion:

1.) ./a.out 128 128 or 256 256 or 512 512 or 1024 1024 does not crash,
    so you don't always get the fault.

2.) The problem might be the status of a singular matrix:

status = LU_decomp_L3 (&AL.matrix, ipiv);

If not singular then status = 0 and all fields of vector ipiv are valid(have been processed).

if singular then status = number of fields which have been processed.

For example: singular 127x127 status = 16
means that this is wrong:
for (i = 0; i < minMN; ++i) {  # the segfault area

Better is this:
size_t damage = minMN;
if (status) damage = status;
for (i = 0; i < damage; ++i) {


Even better (perhaps)
if (status)  { ; /* singular, do nothing */
} else {
   for (i = 0; i < minMN; ++i) {
   :
}
gsl_vector_uint_free(ipiv);
return status;

Performance back: no calloc and in case of singular dismiss signum as valueless.

Andrew Davison <infradig>
Fri 26 Jul 2024 11:41:39 PM UTC, comment #2: 

Oops, forgot

$ export LD_LIBRARY_PATH=$HOME/tools/gsl/gsl-release-2-8/.libs:$HOME/tools/gsl/gsl-release-2-8/cblas/.libs

Andrew Davison <infradig>
Fri 26 Jul 2024 11:40:23 PM UTC, comment #1: 

### Set to 0

$ rm a.out
~/tools/gsl/gsl-release-2-8  $ gcc -I$HOME/tools/gsl/gsl-release-2-8 ~/trealla/x.c -L$HOME/tools/gsl/gsl-release-2-8/.libs -L$HOME/tools/gsl/gsl-release-2-8/cblas/.libs -lgsl -lgslcblas -lm
~/tools/gsl/gsl-release-2-8  $ ./a.out 127 127
v2.8 127x127
-0.000000

### NOW change to 1

~/tools/gsl/gsl-release-2-8  $ gcc -I$HOME/tools/gsl/gsl-release-2-8 ~/trealla/x.c -L$HOME/tools/gsl/gsl-release-2-8/.libs -L$HOME/tools/gsl/gsl-release-2-8/cblas/.libs -lgsl -lgslcblas -lm
~/tools/gsl/gsl-release-2-8  $ ./a.out 127 127
v2.8 127x127
Segmentation fault (core dumped)
~/tools/gsl/gsl-release-2-8  $


(file #56320)

Andrew Davison <infradig>
Fri 26 Jul 2024 02:56:44 AM UTC, original submission:  

At line 75 in lu.c the call

  gsl_vector_uint * ipiv = gsl_vector_uint_alloc(minMN);

is made. The ipiv vector is then used in a manner that seems to expect zeroed values. This causes a runtime crash if the circumstances conspire to present such that the allocated memory is not zeroed. Note: simple tests seem to not show this problem making it hard to reproduce in a standalone unit test, sorry.

This problem can be prevented by changing the call to

  gsl_vector_uint * ipiv = gsl_vector_uint_calloc(minMN);

instead. In my application tests this now always works.

Andrew Davison <infradig>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #56718:  bug_66026.patch added by mangrove84 (3KiB - text/x-patch)
file #56320:  x.c added by infradig (782B - text/x-csrc - Use to reproduce)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mangrove84 (Updated the item)
  • -email is unavailable- added by infradig (Submitted the item)
  •  

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-12-27 mangrove84 Attached File- Added bug_66026.patch, #56718
    2024-07-26 infradig Attached File- Added x.c, #56320

    Back to the top

    Powered by Savane 3.14-04e1.
    Corresponding source code