Henry Wong
2004-02-07 06:17:04 UTC
From my understanding of the problem, it is legal to have a CNF file as
follows:
p cnf 0 0
i.e. 0 variables, and 0 clauses. (In which case the result should be
"SAT")
Since there are 0 variables, the expected vector file (VEC) is empty
(i.e. contains a 0-character string)
main.c: 55:
fgets(vec, solver->numVars+1, fs);
If fgets fails (and returns NULL), main.c makes no attempt at catching
it, and passes vec *uninitialized* into setVariables. (Insufficient
error checking in main.c?)
If (solver->numVars == 0) (which should be legal input)
fgets is instructed to read 0 characters + 1 null terminator.
In GCC (but not Borland C++Builder), this causes fgets to fail (and
return null, and is not trapped by main.c).
(char*)vec is then blindly passed into setVariables, where an error
occurs because a (usually) random string was passed into setVariables
when it was expecting a 0-length string.
In summary:
* 0 variables is a legal input scenario
* if fgets fails (main.c:55), (char*)vec is passed unitialized into
setVariables
* fgets does fail on GCC when there are 0 variables. (i.e. when fgets is
told to read 1 character)
Fail: gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-113) [on ecf
linux]
Fail: gcc version 3.3.1 (cygming
special) [on cygwin/win32]
Succeed: Borland C++Builder
5.0 [on win32]
Possible fixes?
- Guarantee numVar for any test data > 0, and vector file not empty
- Trap fgets errors in main.c
- ???
follows:
p cnf 0 0
i.e. 0 variables, and 0 clauses. (In which case the result should be
"SAT")
Since there are 0 variables, the expected vector file (VEC) is empty
(i.e. contains a 0-character string)
main.c: 55:
fgets(vec, solver->numVars+1, fs);
If fgets fails (and returns NULL), main.c makes no attempt at catching
it, and passes vec *uninitialized* into setVariables. (Insufficient
error checking in main.c?)
If (solver->numVars == 0) (which should be legal input)
fgets is instructed to read 0 characters + 1 null terminator.
In GCC (but not Borland C++Builder), this causes fgets to fail (and
return null, and is not trapped by main.c).
(char*)vec is then blindly passed into setVariables, where an error
occurs because a (usually) random string was passed into setVariables
when it was expecting a 0-length string.
In summary:
* 0 variables is a legal input scenario
* if fgets fails (main.c:55), (char*)vec is passed unitialized into
setVariables
* fgets does fail on GCC when there are 0 variables. (i.e. when fgets is
told to read 1 character)
Fail: gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-113) [on ecf
linux]
Fail: gcc version 3.3.1 (cygming
special) [on cygwin/win32]
Succeed: Borland C++Builder
5.0 [on win32]
Possible fixes?
- Guarantee numVar for any test data > 0, and vector file not empty
- Trap fgets errors in main.c
- ???