src/spicelib/parser/inpptree.c, bug fix, B expression of kind `max(0,expr)'

identified and reported by Marcel Hendrix,
expressions of this kind could trigger a segmentation violation.

PTdifferentiate() roughly evaluates to
  ternary_fcn(ge0(0-expr), 0, PTdifferentate(expr))
and mkb() optimizes
  0 - expr --> unary_minus(expr)

IFeval() invokes PTeval() for the derivative too,
PTeval() looks at the incorrect tree->funcnum
  and tries to PTeval for a second argument which is not there,
     (unary_minus does not have a second argument)
  causing a segmentation fault.
This commit is contained in:
rlar 2016-02-24 18:56:14 +01:00
parent c0eff98522
commit d0897fd0c4
2 changed files with 14 additions and 2 deletions

View File

@ -827,7 +827,7 @@ static INPparseNode *mkf(int type, INPparseNode * arg)
p->left = inc_usage(arg);
p->funcnum = i;
p->funcnum = funcs[i].number;
p->function = funcs[i].funcptr;
p->funcname = funcs[i].name;

View File

@ -507,6 +507,18 @@ v1151_g n1151_g 0 '1'
v1152_g n1152_g 0 '1'
v1153_g n1153_g 0 '0'
* ----------------------------------------
* special regression test unveils ...
* max(a,b)
vaux1 n42 0 dc 42.0
b1154_t n1154_t 0 v = max(0, v(n42))
b1155_t n1155_t 0 v = max(v(n42), 0)
v1154_g n1154_g 0 '42.0'
v1155_g n1155_g 0 '42.0'
.control
define mismatch(a,b,err) abs(a-b)>err
@ -516,7 +528,7 @@ op
let total_count = 0
let fail_count = 0
let tests = 1001 + vector(153)
let tests = 1001 + vector(155)
foreach n $&tests
set n_test = "n{$n}_t"