coin-or / coin-or/CoinUtils

buffer overflow detected when adding 10 million or more columns

Open
#199 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
C++
Stars
53
Forks
47
PR merge metrics
No merged PRs in 30d

Description

When adding the 10 millionth column to a CoinModel I get the following error message:
*** buffer overflow detected *** : ./solver terminated
A stack trace shows that the error occurs during CoinModel::addColumn(int, int const*, double const*, double, double, double, char const*, bool) () from /usr/lib/x86_64-linux-gnu/libCoinUtils.so.3
The next function on the stack trace was ___sprintf_chk which suggests that the problem is an overflow writing to a string.

Examining the code, I believe the issue is the format limitation of 7 characters for the number when creating a default name in addColumn. This makes sense because 10000000 is the first integer that requires 8 characters in a string.
https://github.com/coin-or/CoinUtils/blob/ee7c023ca38d39fc4c13a98bc883c1085ff2cb35/src/CoinModel.cpp#L929-L935

Increasing this limit from 7 characters to 10 characters would allow up to 9.999 * 10^9 = almost 10 billion variables, which is way more than anyone could practically solve.

Currently, I can work around this issue by setting noNames to true in the CoinModel constructor. I have confirmed that setting noNames to true prevents the error.

Although I understand that 10 million variables may be more variables than Coin was designed for, it solves in a reasonable time. My program, which uses Coin to solve 2 problems with over 10 million variables, finishes running in 12 minutes on my laptop.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in src/CoinModel.cpp at lines 929-935 and inspect CoinModel::addColumn, especially the default-name formatting used when adding columns. Reproduce the failure at 10 million columns, then verify that named columns no longer trigger a buffer overflow and that the noNames workaround is unnecessary.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
tooling
Issue type
Bug
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.