9ee0028132
Found while sweeping the file-parser code models (d_state/d_source/xfer/ file_source); confirmed with AddressSanitizer. Unlike the earlier code-model finds (E-246/247/250, reads or bounded errors), these are out-of-bounds WRITES -- silent heap corruption. 1. xfer (analog/xfer/cfunc.mod, read_file): reads a transfer-function file (a Touchstone-style `#` option line then data). It sscanf's up to 9 values per line and a state machine stores every value (freq/real/imag triples), so a line with more than one record stores more than 3. The allocation check reserved only 3 (`if (i + 3 > size)`, ALLOC=1024), so a multi-record line wrote past the buffer at the 1024-double boundary (ASan: heap-buffer-overflow WRITE, cm_xfer). Fix: reserve the sscanf maximum of 9 (`if (i + 9 > size)`). 2. file_source (analog/file_source/cfunc.mod): stores one record per line -- a timepoint plus `size` channel values = stepsize (size+1) doubles -- but reserved only `size` (`vecallocated - size`), one short. At the reallocation boundary the final channel wrote one double past the end (ASan: heap-buffer-overflow WRITE, cm_filesource). Fix: reserve a full record (`- stepsize`). Both are heap OOB writes reachable from a valid-syntax netlist with a crafted data file; the release build corrupts adjacent heap silently rather than always crashing (UB either way). The sibling parsers were checked: d_source validates its per-line token count against the declared width, and d_state's fixed line buffer is fgets-bounded -- no analogous overrun. Code-model-only change: analog.cm regenerated via cmpp and redeployed under bin/*/codemodels/; the ngspice binary is unchanged. Verify (examples/filefix_examples, 4 checks x2 solvers): valid transfer-function and file_source files simulate; an xfer multi-record file and a boundary-crossing file_source file run without overrunning. Both reproduced under ASan and shown fixed. Full regression 208/208. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| examples | ||
| m4 | ||
| man | ||
| paranoia_parallel | ||
| src | ||
| tests | ||
| visualc | ||
| .gitattributes | ||
| .gitignore | ||
| ANALYSES | ||
| AUTHORS | ||
| BUGS | ||
| COPYING | ||
| ChangeLog | ||
| DEVICES | ||
| Dockerfile | ||
| FAQ | ||
| INSTALL | ||
| INTERNALS | ||
| Install-Ubuntu.txt | ||
| Makefile.am | ||
| NEWS | ||
| README | ||
| README.SEEgenerator | ||
| README.cpl-gc | ||
| README.optran | ||
| README.shared-xspice | ||
| README.tcl | ||
| README.utf8 | ||
| README.vdmos | ||
| README.wavsim | ||
| README_OSDI.md | ||
| README_OSDI_howto | ||
| Stuarts_Poly_Notes | ||
| autogen.sh | ||
| build-for-mac-os.sh | ||
| compile_cyg_make_short_check_64.sh | ||
| compile_linux.sh | ||
| compile_linux_dist.sh | ||
| compile_linux_shared.sh | ||
| compile_macos_clang.sh | ||
| compile_macos_clang_M2.sh | ||
| compile_macos_clang_M2_shared.sh | ||
| compile_macos_gcc.sh | ||
| compile_macos_shared.sh | ||
| compile_min.sh | ||
| compile_min_shared.sh | ||
| configure.ac | ||
| cross-compile-shared.sh | ||
| cross-compile.sh | ||
| ngspice.pc.in | ||
README
README for NGSPICE ================== Ngspice is a mixed-level/mixed-signal circuit simulator. Its code is based on three open source software packages: Spice3f5, Cider1b1 and Xspice. Spice3 does not need any introduction, it is the ancestor of many commercial or open source circuit simulators. In over 30 years since its existence it has set several de-facto standards for simulating circuits. Cider couples the Spice3 circuit level simulator to a device simulator to provide greater simulation accuracy of critical devices. So you may create device models for diodes, bipolar, JFet and MOSFETs derived from their cross-sectional structures and materials. Xspice is an extension to Spice3 that provides code modelling support and simulation of digital components through an embedded event driven algorithm. Ngspice is, anyway, much more than the simple sum of the packages above, as many people contributed to the project with their experience, their bug fixes and their improvements. If you are interested, browse the site and discover what ngspice offers and what needs. If you think you can help, join the development team. Ngspice is an ongoing project, growing everyday from users contributions, suggestions and reports. What we will be able to do depends mostly on user interests, contributions and feedback. USER DISCUSSION FORUMS: ----------------------- For discussions on ngspice, there are five discussion forums, to be found at https://sourceforge.net/p/ngspice/discussion/. These typically provide quick answers to any question concerning ngspice. A new section on 'tips and examples' assembles useful tips provided by maintainers and users. MAILING LISTS: ------------- There are two mailing lists dedicated to the use and development of ngspice. * ngspice-users@lists.sourceforge.net: This list is the list for the users of the ngspice simulator. * ngspice-devel@lists.sourceforge.net: ngspice development issues. Developers and "want to be" developers should subscribe here. To subscribe the list(s), send a message to: <ngspice-users-subscribe@lists.sourceforge.net> <ngspice-devel-subscribe@lists.sourceforge.net> WEB SITEs: -------- This project is hosted on Sourceforge.net. The home page is https://ngspice.sourceforge.io The page offering source code, MS Windows executables, and user interaction is https://sourceforge.net/projects/ngspice