[Bug-libmatheval] crash in libmatheval, on 64 bit arch's (AMD64)

[Dave Andruczyk]

I had a user of my software report a segfault  regarding libmatheval. (I used a
version of it and integrated it into my program, with no modificatiosn to it's
routines)

Here's the GDB info:

 Program received signal SIGSEGV, Segmentation fault. 
 [Switching to Thread 46912564793952 (LWP 1465)] 
 hash (s=0x0, n=211) at symbol_table.c:258 
 258             for (p = s; *p; p++) { 
 (gdb) 

I looked into that function (libmatheval 1.1.1) and there isn't anything there
that checks the size of the pointers. (I believe pointers on 64 bit arch's are
64 bits wide, not 32 bit,)

the offending function is:

/* Function below reused from A.V. Aho, R. Sethi, J.D. Ullman, "Compilers
 * - Principle, Techniques, and Tools", Addison-Wesley, 1986, pp 435-437,
 * and in turn from P.J. Weineberger's C compiler. */
static int
hash(char *s, int n)
{
        char           *p;
        unsigned        h,
                        g;

        h = 0;

        for (p = s; *p; p++) {
                h = (h << 4) + *p;
                if ((g = h & 0xf0000000)) {
                        h = h ^ (g >> 24);
                        h = h ^ g;
                }
        }

        return h % n;
}

The other inconsistency is that "h" ad "g" are not defined to be an explicit
type. (they are just declared as "unsigned" not unsigned {char, int, float,
long, long long, etc}..)



Dave J. Andruczyk


                
____________________________________________________
Start your day with Yahoo! - make it your home page 
http://www.yahoo.com/r/hs