Re: Uninitialized memory bug found in /mpn/generic/mod_1_1.c

2023-08-31 Thread Brett Kuntz
I have dug deeper into understanding what happens with both versions (method 1 & 2). If the divisor has a high bit set, then pre[2] is not initialized inside mpn_mod_1_1p_cps(), but it is also not used inside mpn_mod_1_1p() as there are no leading zeroes. In the other scenario, if the high

Re: Uninitialized memory bug found in /mpn/generic/mod_1_1.c

2023-08-31 Thread Brett Kuntz
> Looking at mpn/generic/mod_1_1.c, > if MOD_1_1P_METHOD == 1, the value[2] in the array is always set and always > used; > if MOD_1_1P_METHOD == 2, the value[2] is set only if cnt!=0, and it is used > only if cnt!=0. > There are also some assembler code implementations, each one with its

Re: Uninitialized memory bug found in /mpn/generic/mod_1_1.c

2023-08-31 Thread marco . bodrato
Ciao, 31 ago 2023, 18:06 da vinc...@vinc17.net: > I don't think that this is sufficient for the test. > The code Brett mentioned is for MOD_1_1P_METHOD = 2. > The code Brett mentioned is mixed, I fear. Looking at mpn/generic/mod_1_1.c,if MOD_1_1P_METHOD == 1, the value[2] in the array is

Re: Uninitialized memory bug found in /mpn/generic/mod_1_1.c

2023-08-31 Thread Vincent Lefevre
On 2023-08-31 17:03:12 +0200, marco.bodr...@tutanota.com wrote: > Ciao, > > 31 ago 2023, 16:30 da ku...@shaw.ca: > > > 1) Edit line 248 mpn/generic/mp_limb_t pre[4]; into: > > > ~/src/gmp$ hg diff mpn/generic/ > diff -r 3ac5afa36be5 mpn/generic/mod_1.c > --- a/mpn/generic/mod_1.c   Wed Nov

Re: Uninitialized memory bug found in /mpn/generic/mod_1_1.c

2023-08-31 Thread marco . bodrato
Ciao, 31 ago 2023, 16:30 da ku...@shaw.ca: > 1) Edit line 248 mpn/generic/mp_limb_t pre[4]; into: > ~/src/gmp$ hg diff mpn/generic/ diff -r 3ac5afa36be5 mpn/generic/mod_1.c --- a/mpn/generic/mod_1.c   Wed Nov 02 13:48:37 2022 +0100 +++ b/mpn/generic/mod_1.c   Thu Aug 31 16:46:35 2023

Re: Uninitialized memory bug found in /mpn/generic/mod_1_1.c

2023-08-31 Thread Torbjörn Granlund
Brett Kuntz writes: Go to line 248 inside mpn/generic/mod_1.c mp_limb_t pre[4]; There is no such thing on an unedited version of GMP 6.3, not on line 248 not anyplace else in that file. mpn_mod_1_1p_cps (pre, b); Only initializes pre[0], pre[1], and pre[3]. ***NOT*** pre[2].

Re: Uninitialized memory bug found in /mpn/generic/mod_1_1.c

2023-08-31 Thread Brett Kuntz
> It does not exist, only pre[0] through pre[3] does. pre[4] **IS** pre[0] through pre[3] Go to line 248 inside mpn/generic/mod_1.c mp_limb_t pre[4]; That is NOT initialized. The next line: mpn_mod_1_1p_cps (pre, b); Only initializes pre[0], pre[1], and pre[3]. ***NOT*** pre[2].

Re: Uninitialized memory bug found in /mpn/generic/mod_1_1.c

2023-08-31 Thread Torbjörn Granlund
Brett Kuntz writes: Take a look at function mpn_mod_1() in /mpn/generic/ mod_1.c on lines 248 - 250 mp_limb_t pre[4]; mpn_mod_1_1p_cps (pre, b); mp_limb_t pre[4] is not initialized It does not exist, only pre[0] through pre[3] does. and the mpn_mod_1_1p_cps() function never

Uninitialized memory bug found in /mpn/generic/mod_1_1.c

2023-08-31 Thread Brett Kuntz
Hello, today I found a bug in the latest GMP (6.3) using uninitialized memory in /mpn/generic/mod_1_1.c while trying to understand some functions like mpn_mod_1_1p_cps. Take a look at function mpn_mod_1() in /mpn/generic/ mod_1.c on lines 248 - 250 mp_limb_t pre[4]; mpn_mod_1_1p_cps (pre, b);