Re: bug report (.roots member function)

[Gerhard Niklasch <nikl@mathematik.tu-muenchen.de>]

(Moving this from pari-users to pari-dev, and Cc'ing Cliff Bergman
in case he isn't subscribed to the latter: apologies if you get
this twice, Cliff!)

In response to:
> Message-Id: <200004131920.OAA10409@orion.math.iastate.edu>
> Date: Thu, 13 Apr 2000 14:20:06 -0500
> From: Cliff Bergman <cbergman@iastate.edu>
> To: pari-users@list.cr.yp.to
> Subject: bug report
> 
> Hello.  I just (twice) got an error starting from a clean invocation of gp
> 2.0.17 (under Redhat Linux 6.1) after the following computations:
> 
> ? ec=[0,0,0,-Mod(1,13),-Mod(3,13)]
> %1 = [0, 0, 0, Mod(12, 13), Mod(10, 13)]
> ? c=ellinit(ec,1)
> %2 = [0, 0, 0, Mod(12, 13), Mod(10, 13), 0, Mod(11, 13), Mod(1, 13), Mod(12, 13), Mod(9, 13), Mod(5, 13), Mod(11, 13), Mod(6, 13)]
> ? c.disc
> %3 = Mod(11, 13)
> ? c.roots
>   ***   segmentation fault: bug in GP (please report).
> 
> I'm just doing as requested: reporting the error.  Enjoy!

Thanks!

Still present in 2.0.19.beta (on Solaris, I get a Bus Error / SIGBUS),
and the mechanism is fairly obvious:  the .roots member function appears
to look blindly for one of the last six components of the curve, but
since ellinit was called with flag=1, there are only 13 instead of 19
components.  (I tried a few curves of either kind.)

The culprit is src/language/anal.c :
===8<---
static GEN
mroots(GEN x) /* roots */
{
  int t; GEN y = get_nf(x,&t);
  if (!y)
  {
    if (t == typ_ELL) return (GEN)x[14]; /* <<< here --GN */
    if (t == typ_GAL) return (GEN)x[3];
    err(member,"roots",mark.member,mark.start);
  }
  return (GEN)y[6];
}
--->8===
(And last I checked the CVS archive, about 1 minute ago, it's
still like this.)

I guess it should return gzero when x[14] is beyond the length
of x --- comments anyone?

Cheers, Gerhard