A divide by zero bug in lib/math/rational.c (with triggering input)

Yiyuan guo
2021-05-21T05:09:28Z

In the file lib/math/rational.c, the function
rational_best_approximation has the following
code:

void rational_best_approximation(
unsigned long given_numerator, unsigned long given_denominator,
unsigned long max_numerator, unsigned long max_denominator,
unsigned long *best_numerator, unsigned long *best_denominator) {
...
if ((n2 > max_numerator) || (d2 > max_denominator)) {
unsigned long t = min((max_numerator - n0) / n1,
(max_denominator - d0) / d1);
...
}

d1 may be equal to zero when performing the division, leading to a
divide by zero problem.

One input to trigger the divide by zero bug is:
rational_best_approximation(31415, 100, (1 << 8) - 1, (1 << 5) - 1, &n, &d)