# \[bug:trunk\] invalid memory access in 100\*\*900

**URL:** <https://www.ruby-forum.com/t/bug-trunk-invalid-memory-access-in-100-900/177435>\
**Category:** Development\
**Created:** [October 17, 2009, 2:04am UTC](https://www.ruby-forum.com/t/bug-trunk-invalid-memory-access-in-100-900/177435 "2009-10-17T02:04:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tanaka\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c67d28/32.png) [@Tanaka\_A](https://www.ruby-forum.com/u/Tanaka_A)\
**Post date:** [October 17, 2009, 2:04am UTC](https://www.ruby-forum.com/t/bug-trunk-invalid-memory-access-in-100-900/177435/1 "2009-10-17T02:04:22Z")

</div>

e$B0J2\<$N$h$&$K!“e(B100\*\*900  
e$B$r7W;;$9$k$HJQ$J$H$3$m$r%”%/%;%9$9$k$h$&$G$9!#e(B

% valgrind ./ruby -ve ‘100\*\*900’  
==30546== Memcheck, a memory error detector.  
==30546== Copyright © 2002-2007, and GNU GPL’d, by Julian Seward et  
al.  
==30546== Using LibVEX rev 1854, a library for dynamic binary  
translation.  
==30546== Copyright © 2004-2007, and GNU GPL’d, by OpenWorks LLP.  
==30546== Using valgrind-3.3.1-Debian, a dynamic binary instrumentation  
framework.  
==30546== Copyright © 2000-2007, and GNU GPL’d, by Julian Seward et  
al.  
==30546== For more details, rerun with: -v  
==30546==  
ruby 1.9.2dev (2009-10-17 trunk 25379) [i686-linux]  
==30546== Invalid read of size 1  
==30546== at 0x4024980: memcpy (mc\_replace\_strmem.c:402)  
==30546== by 0x816D731: big\_split (bignum.c:1851)  
==30546== by 0x816D8D4: bigmul1\_karatsuba (bignum.c:1874)  
==30546== by 0x816E549: bigmul0 (bignum.c:2055)  
==30546== by 0x816FC3B: bigsqr (bignum.c:2552)  
==30546== by 0x816FF06: rb\_big\_pow (bignum.c:2604)  
==30546== by 0x80894C5: int\_pow (numeric.c:2451)  
==30546== by 0x80896E1: fix\_pow (numeric.c:2508)  
==30546== by 0x81464CC: call\_cfunc (vm\_insnhelper.c:292)  
==30546== by 0x8146346: vm\_call\_cfunc (vm\_insnhelper.c:386)  
==30546== by 0x8145885: vm\_call\_method (vm\_insnhelper.c:511)  
==30546== by 0x8141559: vm\_exec\_core (insns.def:994)  
==30546== Address 0x442a1e3 is 3 bytes after a block of size 376  
alloc’d  
==30546== at 0x4023E8C: realloc (vg\_replace\_malloc.c:429)  
==30546== by 0x80635EF: vm\_xrealloc (gc.c:699)  
==30546== by 0x8063734: ruby\_xrealloc (gc.c:761)  
==30546== by 0x8063783: ruby\_xrealloc2 (gc.c:771)  
==30546== by 0x8168E7A: rb\_big\_realloc (bignum.c:120)  
==30546== by 0x8168E9B: rb\_big\_resize (bignum.c:129)  
==30546== by 0x8169428: bigtrunc (bignum.c:207)  
==30546== by 0x816FC43: bigsqr (bignum.c:2552)  
==30546== by 0x816FF06: rb\_big\_pow (bignum.c:2604)  
==30546== by 0x80894C5: int\_pow (numeric.c:2451)  
==30546== by 0x80896E1: fix\_pow (numeric.c:2508)  
==30546== by 0x81464CC: call\_cfunc (vm\_insnhelper.c:292)  
==30546==  
==30546== Invalid read of size 1  
==30546== at 0x4024987: memcpy (mc\_replace\_strmem.c:402)  
==30546== by 0x816D731: big\_split (bignum.c:1851)  
==30546== by 0x816D8D4: bigmul1\_karatsuba (bignum.c:1874)  
==30546== by 0x816E549: bigmul0 (bignum.c:2055)  
==30546== by 0x816FC3B: bigsqr (bignum.c:2552)  
==30546== by 0x816FF06: rb\_big\_pow (bignum.c:2604)  
==30546== by 0x80894C5: int\_pow (numeric.c:2451)  
==30546== by 0x80896E1: fix\_pow (numeric.c:2508)  
==30546== by 0x81464CC: call\_cfunc (vm\_insnhelper.c:292)  
==30546== by 0x8146346: vm\_call\_cfunc (vm\_insnhelper.c:386)  
==30546== by 0x8145885: vm\_call\_method (vm\_insnhelper.c:511)  
==30546== by 0x8141559: vm\_exec\_core (insns.def:994)  
==30546== Address 0x442a1e2 is 2 bytes after a block of size 376  
alloc’d  
==30546== at 0x4023E8C: realloc (vg\_replace\_malloc.c:429)  
==30546== by 0x80635EF: vm\_xrealloc (gc.c:699)  
==30546== by 0x8063734: ruby\_xrealloc (gc.c:761)  
==30546== by 0x8063783: ruby\_xrealloc2 (gc.c:771)  
==30546== by 0x8168E7A: rb\_big\_realloc (bignum.c:120)  
==30546== by 0x8168E9B: rb\_big\_resize (bignum.c:129)  
==30546== by 0x8169428: bigtrunc (bignum.c:207)  
==30546== by 0x816FC43: bigsqr (bignum.c:2552)  
==30546== by 0x816FF06: rb\_big\_pow (bignum.c:2604)  
==30546== by 0x80894C5: int\_pow (numeric.c:2451)  
==30546== by 0x80896E1: fix\_pow (numeric.c:2508)  
==30546== by 0x81464CC: call\_cfunc (vm\_insnhelper.c:292)  
==30546==  
==30546== Invalid read of size 1  
==30546== at 0x4024990: memcpy (mc\_replace\_strmem.c:402)  
==30546== by 0x816D731: big\_split (bignum.c:1851)  
==30546== by 0x816D8D4: bigmul1\_karatsuba (bignum.c:1874)  
==30546== by 0x816E549: bigmul0 (bignum.c:2055)  
==30546== by 0x816FC3B: bigsqr (bignum.c:2552)  
==30546== by 0x816FF06: rb\_big\_pow (bignum.c:2604)  
==30546== by 0x80894C5: int\_pow (numeric.c:2451)  
==30546== by 0x80896E1: fix\_pow (numeric.c:2508)  
==30546== by 0x81464CC: call\_cfunc (vm\_insnhelper.c:292)  
==30546== by 0x8146346: vm\_call\_cfunc (vm\_insnhelper.c:386)  
==30546== by 0x8145885: vm\_call\_method (vm\_insnhelper.c:511)  
==30546== by 0x8141559: vm\_exe: int\_pow (numeric.c:2451)  
==30546== by 0x80896E1: fix\_pow (numeric.c:2508)  
==30546== by 0x81464CC: call\_cfunc (vm\_insnhelper.c:292)  
==30546==  
==30546== ERROR SUMMARY: 4 errors from 4 contexts (suppressed: 29 from  
1)  
==30546== malloc/free: in use at exit: 607,758 bytes in 14,322 blocks.  
==30546== malloc/free: 15,588 allocs, 1,266 frees, 1,628,891 bytes  
allocated.  
==30546== For counts of detected errors, rerun with: -v  
==30546== searching for pointers to 14,322 not-freed blocks.  
==30546== checked 447,132 bytes.  
==30546==  
==30546== LEAK SUMMARY:  
==30546== definitely lost: 464,272 bytes in 9,660 blocks.  
==30546== possibly lost: 0 bytes in 0 blocks.  
==30546== still reachable: 143,486 bytes in 4,662 blocks.  
==30546== suppressed: 0 bytes in 0 blocks.  
==30546== Rerun with --leak-check=full to see details of leaked memory.

---

<div class="post-metadata">

**Author:** ![Tanaka\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c67d28/32.png) [@Tanaka\_A](https://www.ruby-forum.com/u/Tanaka_A)\
**Post date:** [October 17, 2009, 10:30am UTC](https://www.ruby-forum.com/t/bug-trunk-invalid-memory-access-in-100-900/177435/2 "2009-10-17T10:30:00Z")

</div>

e$B1sF#$G$9!#e(B

2009e$BG/e(B10e$B7ne(B17e$BF|e(B9:01 Tanaka A. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> e$B0J2\<$N$h$&$K!“e(B100\*\*900 e$B$r7W;;$9$k$HJQ$J$H$3$m$r%”%/%;%9$9$k$h$&$G$9!#e(B

e$B$9$\_$^$;$s!"e(Boff-by-one e$B%(%i!\<$7$F$^$7$?!#e(B

# Index: bignum.c

— bignum.c (revision 25382)  
+++ bignum.c (working copy)  
@@ -1848,13 +1848,13 @@

```
 while (--hn && !vds[hn + ln]);
 h = bignew(hn += 2, 1);

```

- MEMCPY(BDIGITS(h), vds + ln, BDIGIT, hn);
- BDIGITS(h)[hn - 1] = 0;

- MEMCPY(BDIGITS(h), vds + ln, BDIGIT, hn - 1);

- BDIGITS(h)[hn - 1] = 0; /\* margin for carry \*/

- MEMCPY(BDIGITS(l), vds, BDIGIT, ln);
- BDIGITS(l)[ln - 1] = 0;

- MEMCPY(BDIGITS(l), vds, BDIGIT, ln - 1);

- BDIGITS(l)[ln - 1] = 0; /\* margin for carry \*/

---

<div class="post-metadata">

**Author:** ![Tanaka\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c67d28/32.png) [@Tanaka\_A](https://www.ruby-forum.com/u/Tanaka_A)\
**Post date:** [October 19, 2009, 5:45am UTC](https://www.ruby-forum.com/t/bug-trunk-invalid-memory-access-in-100-900/177435/3 "2009-10-19T05:45:50Z")

</div>

e$B%A%1%C%He(B #2227 e$B$,99?7$5$l$^$7$?!#e(B (by Yui NARUSE)

e$B%9%F!\<%?%9e(B Opene$B$+$ie(BAssignede$B$KJQ99e(B  
e$BC4Ev\<Te(B Yusuke E.e$B$K%;%C%He(B  
ruby -v ruby 1.9.2dev (2009-10-18 trunk 25392)  
[x86\_64-freebsd7.2]e$B$K%;%C%He(B

## r25383e$B$G=$@5:Q$\_$G$9$h$M!)e(B

[http://redmine.ruby-lang.org/issues/show/2227](http://redmine.ruby-lang.org/issues/show/2227)

---

<div class="post-metadata">

**Author:** ![Tanaka\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c67d28/32.png) [@Tanaka\_A](https://www.ruby-forum.com/u/Tanaka_A)\
**Post date:** [October 19, 2009, 4:40pm UTC](https://www.ruby-forum.com/t/bug-trunk-invalid-memory-access-in-100-900/177435/4 "2009-10-19T16:40:19Z")

</div>

e$B%A%1%C%He(B #2227 e$B$,99?7$5$l$^$7$?!#e(B (by Yusuke E.)

e$B%9%F!\<%?%9e(B Assignede$B$+$ie(BClosede$B$KJQ99e(B

> r25383e$B$G=$@5:Q$\_$G$9$h$M!)e(B

## e$B$=$NDL$j$G$9!#e(B

[http://redmine.ruby-lang.org/issues/show/2227](http://redmine.ruby-lang.org/issues/show/2227)