<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I want to report several bugs (passing „-fsanitize=undefined -fsanitize=address“ to gcc helps to find such issues):<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">1.)<o:p></o:p></p>
<p class="MsoNormal">The attached „model1.lp“ causes an heap buffer overflow in Cgl/src/CglPreProcess/CglPreProcess.cpp:5756 CglPreProcess::modified(OsiSolverInterface*, bool, int&, int, int).<o:p></o:p></p>
<p class="MsoNormal">nCuts is 0.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2.)<o:p></o:p></p>
<p class="MsoNormal">The attached model2.mps crashes if Cbc is build with Visual C++ 2013, Visual Studio 2015 or the Intel c++ compiler on Windows in Debug mode for x64.<o:p></o:p></p>
<p class="MsoNormal">The prebuild windows binaries from <a href="https://bintray.com/coin-or/download/Cbc/">
https://bintray.com/coin-or/download/Cbc/</a> also segfault if „cbc.exe model2.mps -gomory off –solve -quit“ is used.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Workaround: add „-feas off“<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">3.)<o:p></o:p></p>
<p class="MsoNormal">There is an (undefined) integer overflow in the hashCut function (all 4 copy&pasted instances: CglProbing.cpp, CglPreprocess.cpp, 2x CbcCountRowCut.cpp):
<o:p></o:p></p>
<p class="MsoNormal">Changing <o:p></o:p></p>
<p class="MsoNormal">union { double d; int i[2]; } xx;<o:p></o:p></p>
<p class="MsoNormal">To<o:p></o:p></p>
<p class="MsoNormal">union { double d; unsigned int i[2]; } xx;<o:p></o:p></p>
<p class="MsoNormal">fixes this one – unsigned overflow is defined.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">4.)<o:p></o:p></p>
<p class="MsoNormal">Several memcpy calls with num=0 and source=NULL. I don’t think that there is any libc that does not get this right.
<o:p></o:p></p>
<p class="MsoNormal">Nevertheless it is not defined. See <a href="https://youtu.be/yG1OZ69H_-o?t=3288">
https://youtu.be/yG1OZ69H_-o?t=3288</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Fix is trivial: if(num > 0) { memcpy(); } (or use a container from STL).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">CbcModel.cpp line 7067 and 7076<o:p></o:p></p>
<p class="MsoNormal">CglPreProcess.cpp line 2216 and 6408<o:p></o:p></p>
<p class="MsoNormal">CglTreeInfo.cpp line 1237 and 1241<o:p></o:p></p>
<p class="MsoNormal">ClpParameters.hpp line 86<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">5.)<o:p></o:p></p>
<p class="MsoNormal">CglGomory.numberTimesStalled_ is used before initialized for some lp. Trivial to fix by adding „ = 0;“ in CglGomory.hpp line 187.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">6.) <o:p></o:p></p>
<p class="MsoNormal">-DGOMORY_LONG (in trunk) only delays the interger overflow to CglGomory.cpp line 1193.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">7.)<o:p></o:p></p>
<p class="MsoNormal">Calling Cbc via CbcMain1 is not threadsafe, even with CBC_THREAD_SAFE is defined. I do not know the reason, but perhaps related to the global variables. It tends to crash randomly if several problems are solved in parallel (at least on
windows).<o:p></o:p></p>
<p class="MsoNormal">Solving multiple problems in sequence reduces the probability, but crashes from time to time, too. Sadly I can’t provide an example application that crashes with high probability.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is there some way to create a Pull Request or the like for trivial stuff like 3.)? That would simplify things a lot.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Tobias<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>