Re: A divide by zero bug in lib/math/rational.c (with triggering input)

[Yiyuan guo]

Thanks for your timely response.

I am not familiar with the theorem. But any input satisfying the
condition below will
trigger a divide by zero at the first loop iteration:

(given_numerator / given_denominator > max_numerator) || (1 +
given_numerator / given_denominator > max_denominator)

I think such a condition is rather complex and may not be enforced by
all callers of this function.

On Fri, May 21, 2021 at 3:42 PM Andy Shevchenko
<andy.shevchenko@xxxxxxxxx> wrote:
>
>
>
> On Friday, May 21, 2021, Andy Shevchenko <andy.shevchenko@xxxxxxxxx> wrote:
>>
>>
>>
>> On Friday, May 21, 2021, Yiyuan guo <yguoaz@xxxxxxxxx> wrote:
>>>
>>> In the file lib/math/rational.c, the function
>>> rational_best_approximation has the following
>>> code:
>>>
>>> void rational_best_approximation(
>>>     unsigned long given_numerator, unsigned long given_denominator,
>>>     unsigned long max_numerator, unsigned long max_denominator,
>>>     unsigned long *best_numerator, unsigned long *best_denominator) {
>>>    ...
>>>    if ((n2 > max_numerator) || (d2 > max_denominator)) {
>>>             unsigned long t = min((max_numerator - n0) / n1,
>>>                           (max_denominator - d0) / d1);
>>>    ...
>>> }
>>>
>>> d1 may be equal to zero when performing the division, leading to a
>>> divide by zero problem.
>>>
>>> One input  to trigger the divide by zero bug is:
>>> rational_best_approximation(31415, 100, (1 << 8) - 1, (1 << 5) - 1, &n, &d)
>>
>>
>>
>> Have you read a theorem about this? TL;DR; as far as I can see the input data is not suitable for this function.
>>
>
>
> I think we may add the proper check and saturate the output which in your case should be (255,1).
>
>>
>>
>> --
>> With Best Regards,
>> Andy Shevchenko
>>
>>
>
>
> --
> With Best Regards,
> Andy Shevchenko
>
>