Bug 337394

Summary: kcalc crashes left shifting a large number
Product: [Applications] kcalc Reporter: roel <roel.kluin>
Component: generalAssignee: Evan Teran <evan.teran>
Status: RESOLVED WORKSFORME    
Severity: crash CC: fabian, marcin.slusarz
Priority: NOR    
Version First Reported In: 2.13   
Target Milestone: ---   
Platform: Ubuntu   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:

Description roel 2014-07-12 12:03:47 UTC
When entering a large number, pressing left shift twice crashes kcalc. The reason seems to be that kcalc shifts without testing whether it is valid. I think replacing the functions in kcalc_core.cpp with something like this - untested - may fix it.

KNumber ExecLsh(const KNumber &left_op, const KNumber &right_op) {
    if ((right_op < 0) || (right_op >= sizeof(KNumber) * 8)) 
        return left_op;
    return left_op << right_op;
}

KNumber ExecRsh(const KNumber &left_op, const KNumber &right_op) {
    if ((right_op < 0) || (right_op >= sizeof(KNumber) * 8)) 
        return left_op;
    return left_op >> right_op;
}
Comment 1 Evan Teran 2014-07-17 02:45:35 UTC
Thank you for the bug report. This does appear to be a real issue, though your fix does not seem to be correct. sizeof(KNumber) is not really a sensical operation as it is taking the size of a c++ object (which just wraps a pointer to an abstract class. KNumber is not simply a typedef to something like a "long double", but it is actually an implementation of an infinite (well limited by ram) precision math library.

So, if KNumber is infinite precision, then what's the real problem?

When you click the shift operator twice, essentially you are asking kcalc to shift the value by itself. For example:

x << << =

is the same as:

x << x =

Since this is an arbitrary precision calculator. That operation is the same as:

x = x * pow(2, x);

as you can imagine, for a sufficiently large number. The result will easily be a number that will simply not fit in RAM... thus a crash when it tries to allocate space for it.

I will investigate the ideal solution for this issue. Thank you for the report.
Comment 2 Christoph Feck 2015-08-12 09:00:07 UTC
*** Bug 351187 has been marked as a duplicate of this bug. ***
Comment 3 Christoph Feck 2016-02-23 22:07:01 UTC
*** Bug 359721 has been marked as a duplicate of this bug. ***
Comment 4 Justin Zobel 2020-12-17 05:23:01 UTC
Thank you for the crash report.

As it has been a while since this was reported, can you please test and confirm if this issue is still occurring or if this bug report can be marked as resolved.

I have set the bug status to "needsinfo" pending your response, please change back to "reported" or "resolved/worksforme" when you respond, thank you.
Comment 5 Bug Janitor Service 2021-01-01 04:34:59 UTC
Dear Bug Submitter,

This bug has been in NEEDSINFO status with no change for at least
15 days. Please provide the requested information as soon as
possible and set the bug status as REPORTED. Due to regular bug
tracker maintenance, if the bug is still in NEEDSINFO status with
no change in 30 days the bug will be closed as RESOLVED > WORKSFORME
due to lack of needed information.

For more information about our bug triaging procedures please read the
wiki located here:
https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging

If you have already provided the requested information, please
mark the bug as REPORTED so that the KDE team knows that the bug is
ready to be confirmed.

Thank you for helping us make KDE software even better for everyone!
Comment 6 Bug Janitor Service 2021-01-16 04:34:16 UTC
This bug has been in NEEDSINFO status with no change for at least
30 days. The bug is now closed as RESOLVED > WORKSFORME
due to lack of needed information.

For more information about our bug triaging procedures please read the
wiki located here:
https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging

Thank you for helping us make KDE software even better for everyone!